# CVE-1999-0227: Microsoft Windows NT denial of service in LSASS.EXE

Source: https://junglewise.ai/threats/cve-1999-0227-microsoft-windows-nt-denial-of-service-in-lsass-exe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1997-06-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0227 · Severity: medium · CVSS 5 · Published 1997-06-01

A vulnerability in the Local Security Authority Subsystem Service (LSASS) of Windows NT can allow an attacker to crash the system remotely. LSASS is a critical component responsible for managing security policies and user authentication. If exploited, this issue results in a denial of service, forcing the operating system to stop functioning and requiring a manual restart.

Technologies: [Microsoft Windows Nt](https://junglewise.ai/threats/technologies/windows-nt). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-1999-0227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0227 being exploited in the wild.

**How severe is CVE-1999-0227?** Medium severity, with a CVSS score of 5, published 1 June 1997.

**Which products and versions are affected?** Microsoft Windows NT.

**Is there a fix for CVE-1999-0227?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0227 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-0227?** Check whether you run Microsoft Windows Nt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an access violation within the LSASS.EXE process, specifically affecting the Local Security Authority (LSA) and LSA Remote Procedure Call (LSARPC) interfaces in Windows NT. An attacker can trigger this violation by sending specially crafted requests over the network to the LSARPC service. Successful exploitation causes the LSASS process to terminate unexpectedly, which in turn triggers a system shutdown or hang, resulting in a denial of service. No authentication is required to exploit this flaw. Microsoft addressed this issue in legacy knowledge base article Q154087.

## Affected products

- Microsoft Windows NT

## Timeline

- 1997-06-01: disclosed: Initial publication date

## References

- [http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ154087](http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ154087)

## Related threats

- [Microsoft Windows NT OS Kernel privilege escalation via integer underflow](https://junglewise.ai/threats/cve-2026-42980-microsoft-windows-nt-os-kernel-privilege-escalation-via-integer)
- [Microsoft Windows NT OS Kernel privilege escalation via integer underflow](https://junglewise.ai/threats/cve-2026-42916-microsoft-windows-nt-os-kernel-privilege-escalation-via-integer)
- [Microsoft Windows NT denial of service in SMB logon request](https://junglewise.ai/threats/cve-1999-0225-microsoft-windows-nt-denial-of-service-in-smb-logon-request)
- [Microsoft Windows TCP/IP stack denial of service in IP fragmentation](https://junglewise.ai/threats/cve-1999-0258-microsoft-windows-tcp-ip-stack-denial-of-service-in-ip)
- [War FTP buffer overflow allows remote command execution](https://junglewise.ai/threats/cve-1999-0256-war-ftp-buffer-overflow-allows-remote-command-execution)