Description

Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:18:31.917Z",
  "pubdate": "2026-08-11T17:18:31.917Z",
  "executiveSummary": "This vulnerability is a heap-based buffer overflow affecting the Microsoft Local Security Authority Server (lsasrv).\nThe flaw allows an authorized attacker to achieve remote code execution over a network against vulnerable systems.\nThe high severity of this vulnerability stems from the critical role of the Local Security Authority Subsystem Service (LSASS) in managing local security policy, user authentication, and active directory interactions.\nSuccessful exploitation compromises the integrity and confidentiality of the targeted operating system, potentially granting the attacker complete system-level control.\nAttack capabilities require network access and authorization, enabling malicious actors to leverage established network sessions to execute arbitrary machine-code instructions within the context of the lsasrv process space.\nGiven the system-level privileges inherent to the lsasrv component, exploitation directly undermines core operating system security mechanisms.",
  "technicalDetails": "The vulnerability resides in the Microsoft Local Security Authority Server (lsasrv), specifically within the handling of remote procedure call (RPC) requests or network-based data parsing routines processed by the lsasrv component.\nThe root cause is a classic heap-based buffer overflow condition, occurring when the application allocates an insufficient amount of memory on the heap or fails to adequately validate the size parameters of incoming input buffers before performing memory copy operations.\nAn authorized attacker initiates the attack flow by establishing a network connection to the target system and transmitting a specially crafted sequence of bytes or malformed RPC requests destined for the lsasrv service.\nUpon receiving the malicious input, the vulnerable function within lsasrv processes the oversized data payload without proper bounds checking, causing the input data to overflow the boundaries of the allocated heap chunk.\nThis memory corruption overwrites adjacent heap metadata, control structures, or critical application data structures residing on the heap.\nBy carefully crafting the overflow payload, an advanced attacker can manipulate adjacent heap pointers or function pointers, redirecting the execution flow of the process to arbitrary memory locations containing shellcode.\nBecause the lsasrv service operates with elevated privileges, successful code execution allows the payload to inherit these high-privilege permissions, facilitating full system compromise, installation of persistent backdoors, credential theft, and lateral movement across the network domain."
}