Executive brief
The Local Security Authority Server (lsasrv) is a critical Windows system component responsible for user authentication and security policy enforcement. A heap-based buffer overflow in this component could allow an authenticated local attacker to execute arbitrary code with elevated privileges, potentially compromising the entire system and enabling ransomware deployment or data theft.
Technical details
A heap-based buffer overflow vulnerability exists in Microsoft's Local Security Authority Server (lsasrv), triggered by improper bounds checking on heap-allocated memory. The vulnerability requires local access and an authenticated user account to exploit. An attacker can craft malicious input to overflow the heap buffer, overwriting adjacent memory structures and achieving privilege escalation from an authorized user context to SYSTEM or higher. The attack vector is local with precondition of valid user authentication; network exploitation is not possible. Patches are expected from Microsoft's security updates.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed