CVE-2026-83649: LSASS Out-of-Bounds Read Causes Network Denial of Service

What Happened

Microsoft identified an out‑of‑bounds read in the Local Security Authority Subsystem Service (LSASS) that can be triggered by an attacker with sufficient privileges. The read corrupts internal data structures, causing LSASS to terminate and the system to become unresponsive to authentication requests.

Impact

When LSASS crashes, the machine cannot process logins or network authentication, effectively denying service to users and applications that rely on Kerberos or NTLM. The issue is local; it requires the attacker to have privileged credentials or local access, but once triggered it can affect the entire domain if the compromised host is a domain controller.

What to Do

• Ensure all affected Windows installations are updated with the latest security patch from Microsoft.
• Verify that LSASS is running and monitor for abnormal restarts or memory usage spikes.
• Restrict privileged accounts and enforce least‑privilege principles to limit the ability of an attacker to trigger the exploit.
• Consider implementing application whitelisting or Windows Defender Exploit Guard to block anomalous LSASS activity.

Mitigation and Monitoring

Apply the MSRC patch immediately; without it, the vulnerability remains exploitable. Use event logs (Event ID 7036, 7031) to detect LSASS termination events and correlate with authentication failures.