CVE-2026-20875
📋 TL;DR
A null pointer dereference vulnerability in Windows LSASS allows attackers to cause a denial of service by crashing the service. This affects Windows systems where LSASS is running, potentially disrupting authentication and security policy enforcement.
💻 Affected Systems
- Windows Local Security Authority Subsystem Service (LSASS)
📦 What is this software?
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
Windows 11 25h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
LSASS crashes, causing system-wide authentication failures, inability to log in, and disruption of security policies until system restart.
Likely Case
Temporary denial of service affecting authentication and security policy processing until LSASS restarts automatically or manually.
If Mitigated
Limited impact with proper network segmentation and monitoring; LSASS may restart automatically with minimal disruption.
🎯 Exploit Status
Exploitation requires network access to LSASS; authentication requirements depend on specific service configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update for specific KB number
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20875
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft
2. Restart affected systems to complete patch installation
3. Verify LSASS service is running normally after restart
🔧 Temporary Workarounds
Restrict LSASS Network Access
windowsLimit network access to LSASS using Windows Firewall to reduce attack surface
New-NetFirewallRule -DisplayName "Block LSASS Remote" -Direction Inbound -Program "%SystemRoot%\System32\lsass.exe" -Action Block
Monitor LSASS Health
windowsImplement monitoring to detect and alert on LSASS crashes or restarts
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems running LSASS from untrusted networks
- Deploy additional monitoring and alerting for LSASS service state changes and crashes
🔍 How to Verify
Check if Vulnerable:
Check Windows Update history for applied patches referencing CVE-2026-20875 or verify system version against Microsoft advisoryCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify patch is installed via Windows Update history and confirm LSASS service is running stable version📡 Detection & Monitoring
Log Indicators:
- Event ID 1000 or 1001 in Application logs indicating lsass.exe crash
- Unexpected LSASS service restarts in System logs
Network Indicators:
- Unusual network connections to LSASS process (port 445/tcp or other authentication ports)
- Multiple failed authentication attempts preceding service disruption
SIEM Query:
source="windows" (event_id=1000 OR event_id=1001) process_name="lsass.exe"