Windows LSASS: Local privilege escalation via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Local Security Authority Subsystem Service (LSASS) allows an authorized local attacker to elevate privileges. LSASS handles local authentication and holds credentials, so a successful attack can expose cached credentials and domain admin sessions. The attacker needs a valid low-privileged logon on the target system first; the vulnerability is not remotely exploitable. CVSS 3.1 base score is 7.8 (HIGH).

Affected

• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974 (per third-party tracker, to be confirmed with MSRC)
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870 (per third-party tracker, to be confirmed with MSRC)
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33822 (per third-party tracker, to be confirmed with MSRC)
• Windows 10 and older Server editions: Unknown.

Fixed in

• Security update for the listed builds. Microsoft's advisory is authoritative for the KB numbers.

Workaround

Unknown. No workaround is described in the available sources. Check the MSRC advisory for interim mitigations.

Exploitation

• No known exploitation in the wild and no public proof of concept as of 11 Nov 2026.
• Microsoft's exploit maturity rating is Unproven (E:U).
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• NVD analysis was pending at the time of research; check CISA KEV for updates.

Our recommendation

• Apply the Microsoft security update for the affected builds as part of the regular patch cycle, with high priority for shared workstations, RDS/terminal servers and file servers.
• Confirm the exact affected builds and KB numbers in the MSRC advisory, including Windows 10 and older Server editions.
• Reduce the risk of local privilege escalation by restricting local logons and limiting administrative rights.
• Monitor for credential theft indicators and re-check CISA KEV and the MSRC page for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96016 msrc.microsoft.com
• CVE Record: CVE-2026-96016 www.cve.org
• Strix: CVE-2026-96016 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:51.