A null pointer dereference in the Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to cause a denial of service over the network. The flaw can crash LSASS, disrupting authentication and other security functions and potentially rendering the operating system unusable until a reboot or recovery action is taken.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1; Microsoft Windows Server 2016, 2019, 2022, 2025, and the 23H2 edition, including both standard and Server Core installations. All affected builds rely on LSASS as a core component for local security management.

The CVSS score of 7.5 indicates a medium‑to‑high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. The attack vector is inferred to be unauthenticated network access that triggers the null‑pointer in LSASS; no elevated credentials appear necessary to exploit the flaw.