CVE-2026-40378
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Memory allocation with excessive size vulnerability in Windows LSASS. An unauthorized attacker can remotely cause a denial of service.
Risk Assessment
The attack can crash the LSASS service, preventing user authentication and potentially leading to system unavailability.
Recommendation
Install the security update for Windows LSASS from Microsoft.
Other vulnerabilities in Windows LSASS
See all- CVE-2026-83928High
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
- CVE-2026-83516High
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-70015High
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
- CVE-2026-49799Medium
Uncontrolled resource consumption in Windows LSASS allows an authorized attacker to cause a denial of service over the network.
Original NVD description (English source)
Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS