CVE-2026-69594

CVE-2026-69594 is a heap-based buffer overflow in Microsoft's Local Security Authority Server (lsasrv), the Windows component that implements authentication and security-authority functionality; the associated integer-overflow weakness (CWE-190) suggests a miscalculated size computation leads to the heap overflow. An authorized local user can trigger the flaw by sending crafted data to the LSASS process. Successful exploitation lets the attacker elevate privileges locally, escaping the confines of their assigned low-privilege account on the machine. Any Windows system where a low-privileged user can sign in is potentially affected, which in practice spans nearly the entire Windows installed base. As of this analysis there is no public proof-of-concept, no entry in CISA's KEV catalog, and EPSS estimates only a 0.3% probability of exploitation within 30 days, indicating no known in-the-wild exploitation.

What to do: Apply Microsoft's security update for CVE-2026-69594 via Windows Update as soon as it is available, and check Microsoft's advisory to identify which Windows versions are affected since the source data does not enumerate them. In the interim, restrict interactive logon rights for untrusted users on shared, multi-user, or jump-host systems, because exploitation requires an authorized local account. Monitor LSASS-related process activity for anomalies, noting that no public PoC or known exploitation exists as of this writing.