CVE-2025-53809
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
Risk Assessment
An authorized attacker can remotely cause unavailability of the LSASS service, potentially disrupting authentication and Windows system operation.
Recommendation
Apply Microsoft security updates for Windows and limit privileges of accounts that can interact with the LSASS service.
Other vulnerabilities in Windows Local Security Authority Subsystem Service (LSASS)
See all- CVE-2026-96219Critical
An out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. The flaw occurs when data is written outside the allocated memory area.
- CVE-2026-83649Medium
Out-of-bounds read vulnerability in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
- CVE-2026-20875High
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-20854High
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS