CVE-2026-96219
CriticalCVSS 9.8Summary
An out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. The flaw occurs when data is written outside the allocated memory area.
Risk Assessment
An attacker could remotely execute arbitrary code in the context of the LSASS service, potentially leading to privilege escalation and full system compromise.
Recommendation
Apply the available Microsoft security updates for LSASS as soon as possible and restrict network access to authentication services.
Other vulnerabilities in Windows Local Security Authority Subsystem Service (LSASS)
See all- CVE-2026-20875High
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-20854High
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.
Original NVD description (English source)
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS