CVE-2026-32071 - Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

Back Back to CVE browser

HIGH

Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

Published Apr 14, 2026

7.5

HIGH

CVSS 3.1

EPSS 1.17%

Description

Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Affected products

Vendor Microsoft Product Windows 10 Version 1607 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.9060
Vendor Microsoft Product Windows 10 Version 1809 Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.8644
Vendor Microsoft Product Windows 10 Version 21H2 Default
n/a
- Version
  10.0.19044.0
  Status
  affected
  Constraints
  <10.0.19044.7184
Vendor Microsoft Product Windows 10 Version 22H2 Default
n/a
- Version
  10.0.19045.0
  Status
  affected
  Constraints
  <10.0.19045.7184
Vendor Microsoft Product Windows 11 Version 23H2 Default
n/a
- Version
  10.0.22631.0
  Status
  affected
  Constraints
  <10.0.22631.6936
Vendor Microsoft Product Windows 11 Version 24H2 Default
n/a
- Version
  10.0.26100.0
  Status
  affected
  Constraints
  <10.0.26100.8246
Vendor Microsoft Product Windows 11 Version 25H2 Default
n/a
- Version
  10.0.26200.0
  Status
  affected
  Constraints
  <10.0.26200.8246
Vendor Microsoft Product Windows 11 version 22H3 Default
n/a
- Version
  10.0.22631.0
  Status
  affected
  Constraints
  <10.0.22631.6936
Vendor Microsoft Product Windows 11 version 26H1 Default
n/a
- Version
  10.0.28000.0
  Status
  affected
  Constraints
  <10.0.28000.1836
Vendor Microsoft Product Windows Server 2016 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.9060
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.9060
Vendor Microsoft Product Windows Server 2019 Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.8644
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.8644
Vendor Microsoft Product Windows Server 2022 Default
n/a
- Version
  10.0.20348.0
  Status
  affected
  Constraints
  <10.0.20348.5020
Vendor Microsoft Product Windows Server 2022, 23H2 Edition (Server Core installation) Default
n/a
- Version
  10.0.25398.0
  Status
  affected
  Constraints
  <10.0.25398.2274
Vendor Microsoft Product Windows Server 2025 Default
n/a
- Version
  10.0.26100.0
  Status
  affected
  Constraints
  <10.0.26100.32690
Vendor Microsoft Product Windows Server 2025 (Server Core installation) Default
n/a
- Version
  10.0.26100.0
  Status
  affected
  Constraints
  <10.0.26100.32690

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Windows 10 Version 1607

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.9060

Microsoft

Windows 10 Version 1809

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.8644

Microsoft

Windows 10 Version 21H2

n/a

Version	Status	Constraints
10.0.19044.0	affected	<10.0.19044.7184

Microsoft

Windows 10 Version 22H2

n/a

Version	Status	Constraints
10.0.19045.0	affected	<10.0.19045.7184

Microsoft

Windows 11 Version 23H2

n/a

Version	Status	Constraints
10.0.22631.0	affected	<10.0.22631.6936

Microsoft

Windows 11 Version 24H2

n/a

Version	Status	Constraints
10.0.26100.0	affected	<10.0.26100.8246

Microsoft

Windows 11 Version 25H2

n/a

Version	Status	Constraints
10.0.26200.0	affected	<10.0.26200.8246

Microsoft

Windows 11 version 22H3

n/a

Version	Status	Constraints
10.0.22631.0	affected	<10.0.22631.6936

Microsoft

Windows 11 version 26H1

n/a

Version	Status	Constraints
10.0.28000.0	affected	<10.0.28000.1836

Microsoft

Windows Server 2016

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.9060

Microsoft

Windows Server 2016 (Server Core installation)

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.9060

Microsoft

Windows Server 2019

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.8644

Microsoft

Windows Server 2019 (Server Core installation)

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.8644

Microsoft

Windows Server 2022

n/a

Version	Status	Constraints
10.0.20348.0	affected	<10.0.20348.5020

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

n/a

Version	Status	Constraints
10.0.25398.0	affected	<10.0.25398.2274

Microsoft

Windows Server 2025

n/a

Version	Status	Constraints
10.0.26100.0	affected	<10.0.26100.32690

Microsoft

Windows Server 2025 (Server Core installation)

n/a

Version	Status	Constraints
10.0.26100.0	affected	<10.0.26100.32690

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22496
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32071
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22496		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32071		vendor-advisorypatchVendor Advisory