CVE-2026-40378

Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Description
Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Analysis

AI-generated

Technical impact

The vulnerability involves a memory allocation bug in Windows Local Security Authority Subsystem Service (LSASS) where an excessive size value causes the process to crash or freeze. This leads to a denial of authentication and other security functions, resulting in a loss of availability for the system.

Affected Systems

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations; all affected versions are listed in the documented CNA vendor product list.

Risk and Exploitability

The CVSS score shows high severity (7.5), but the EPSS score of less than 1% indicates that exploitation is currently unlikely. The flaw can be triggered by an unauthorized attacker over a network connection, implying a remote attack vector. The vulnerability is not listed in the CISA KEV catalog, so there is no known widespread exploitation at the time of analysis.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the security update released by Microsoft for all affected Windows 10, Windows 11, and Windows Server versions.
  • Reboot the system after applying the patch to fully unload the vulnerable LSASS module.
  • If a patch is not yet available, mitigate by limiting or blocking unnecessary network access to Windows authentication services, such as disabling or restricting RPC calls to LSASS via firewall or group policy.

Generated by OpenCVE AI on July 31, 2026 at 09:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Title Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-789
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C'}
Weaknesses
  • CWE-789

    Memory Allocation with Excessive Size Value

Sources

Status
PUBLISHED
Assigner
microsoft
Published
Updated
Nov 10, 2026, 10:36 PM
Reserved
Apr 11, 2026, 11:06 PM

View source JSON

Updated
Jul 14, 2026, 5:36 PM

JSON

Status
Analyzed
Published
Jul 14, 2026, 5:16 PM
Modified
Jul 22, 2026, 4:17 PM

View source JSON

No data.

Updated
Nov 11, 2026, 1:00 AM

JSON