Windows LSASS: Stack-based buffer overflow leads to local privilege escalation

Summary

A stack-based buffer overflow in the Windows Local Security Authority Subsystem Service (LSASS) allows an authorized local user to elevate privileges. Successful exploitation would give the attacker SYSTEM-level control over the affected host. The attacker needs local access with low privileges and no user interaction, so the risk arises once an attacker has any foothold on a system.

Affected

• Windows 10 Version 1809 (before 10.0.17763.9487)
• Windows 10 Version 21H2 (before 10.0.19044.7846)
• Windows 10 Version 22H2 (before 10.0.19045.7846)
• Windows 11 Version 23H2 (before 10.0.22631.7711)
• Windows 11 Version 24H2 (before 10.0.26100.9974)
• Windows 11 Version 25H2 (before 10.0.26200.9974)
• Windows 11 Version 26H1 (before 10.0.28000.3501)
• Windows 11 Version 26H2 (before 10.0.26300.9974)
• Windows Server 2019, including Server Core (before 10.0.17763.9487)
• Windows Server 2022 (before 10.0.20348.5870)
• Windows Server 2025, including Server Core (before 10.0.26100.33822)

Fixed in

• Install the Microsoft security update for November 2026 (builds listed in the CVE record as the first non-affected versions for each edition).
• The specific KB numbers per edition are not confirmed by a Microsoft source; check the MSRC advisory before deployment.

Workaround

Unknown. No vendor-published workaround was found. Patching is the expected remediation.

Exploitation

• Not known to be exploited in the wild at publication.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Microsoft's CVSS temporal metrics show exploit code maturity 'Unproven'.
• No public proof of concept was found; this does not prove that none exists.

Our recommendation

• Inventory all Windows 10 1809, 21H2 and 22H2 systems and Windows Server systems, and verify their build numbers.
• Apply the November 2026 security update on the next standard cycle for workstations and servers; prioritise shared, terminal, remote-access and weakly controlled hosts.
• Check the MSRC advisory for the exact KB numbers per edition.
• Monitor CISA KEV and vendor sources for changes in exploitation status.
• Reduce the impact of a foothold by limiting local logons and user privileges.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96066 msrc.microsoft.com
• CVE Record CVE-2026-96066 www.cve.org
• Strix CVE-2026-96066 www.strix.ai
• CISA KEV alert October 2026 www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:40.