A null pointer dereference in the Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to trigger a crash, causing system-wide denial of service. The flaw results in a dereference of a null pointer within LSASS, which runs with kernel privileges. When exploited, the LSASS process terminates unexpectedly, leaving the computer in an unstable state until a reboot occurs. This denial can affect all users and processes that rely on authentication and authorization services.

The flaw affects a wide range of Microsoft Windows client and server operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2 and 22H3, and Windows Server releases such as 2008 R2 SP1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, 2025 and the 23H2 edition. All mainstream 32‑bit, 64‑bit and ARM‑64 variants are impacted where LSASS is present.

The CVSS score of 7.5 marks this issue as high severity, while the EPSS score of less than 1 % indicates that actual exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation has been observed. Attackers would need to reach the target across a network to trigger the null‑pointer dereference, most likely via an unauthenticated packet directed at the LSASS process. Once executed, the resulting crash constitutes a denial‑of‑service attack. Given the critical role of LSASS, the impact is system‑wide, but the low EPSS score mitigates the urgency relative to higher‑probability threats.