CVE-2026-20854

HighCVSS 7.5

Published: 13/01/2026(UTC)Updated: 30/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.04%

61th percentile - higher than 61% of all known CVEs

Summary

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.

Risk Assessment

An attacker can remotely execute malicious code in the context of the LSASS service, leading to compromise of authentication and potentially the entire system.

Recommendation

Install the latest Windows security updates from Microsoft.

Other vulnerabilities in Windows Local Security Authority Subsystem Service (LSASS)

CVE-2026-20875High
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Original NVD description (English source)

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.