An out‑of‑bounds read in the Local Security Authority Subsystem Service (LSASS) can be triggered by sending a specially crafted packet to a vulnerable system, causing LSASS to become unresponsive. This memory‑safety flaw, identified as CWE‑125, prevents legitimate authentication traffic from being processed and leaves the affected machine unable to log in users or authenticate services, thereby disrupting system availability.

Microsoft Windows 10 Version 1809, Windows 11 Versions 24H2, 25H2, 26H2, and 26H1, Windows Server 2019, Windows Server 2019 Server Core, Windows Server 2022, Windows Server 2025, and Windows Server 2025 Server Core installations are all listed as vulnerable.

The CVSS score of 7.5 indicates a high risk for an attacker to achieve a denial of service. An EPSS score of 1% indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker with network access to the target can send the malicious data to LSASS, triggering the crash without any special privileges. Given the potential to deny authentication and cause widespread downtime, the risk to organizations that rely on continuous access is significant.