CVE-2026-32071: Windows LSASS DoS Vulnerability

CVE-2026-32071 Overview

CVE-2026-32071 is a null pointer dereference vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) that allows an unauthorized attacker to cause a denial of service condition over a network. LSASS is a critical Windows component responsible for enforcing security policies, handling user authentication, and managing Active Directory operations. Exploitation of this vulnerability can disrupt authentication services across the affected system, potentially impacting enterprise environments that rely on Windows domain services.

Critical Impact

An unauthenticated remote attacker can crash the LSASS process, causing system instability and forcing a reboot. This can disrupt authentication services and Active Directory operations across affected Windows systems.

Affected Products

• Windows Local Security Authority Subsystem Service (LSASS)
• Microsoft Windows operating systems (refer to Microsoft Security Update for specific affected versions)

Discovery Timeline

• April 14, 2026 - CVE-2026-32071 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32071

Vulnerability Analysis

This vulnerability stems from improper handling of null pointers within the LSASS process. When LSASS receives a specially crafted network request, certain code paths fail to validate pointer references before dereferencing them. This results in a null pointer dereference condition that crashes the LSASS process.

The vulnerability is classified under CWE-476 (NULL Pointer Dereference), which occurs when an application dereferences a pointer that it expects to be valid but is actually NULL. In the context of LSASS, this can be triggered remotely without authentication, making it particularly concerning for exposed Windows systems.

Root Cause

The root cause is a missing null pointer validation check within LSASS when processing certain network authentication requests. The code path assumes that a pointer will always reference valid memory, but under specific conditions triggered by malformed input, the pointer remains null. When the code attempts to access the memory location referenced by this null pointer, the process crashes.

Attack Vector

The attack can be executed remotely over a network without requiring authentication or user interaction. An attacker can send specially crafted packets to the LSASS service on a target Windows system. When LSASS processes this malicious input, the null pointer dereference is triggered, causing the process to crash. Since LSASS is a critical system process, this crash typically results in system instability and may force an automatic reboot.

The attack does not grant the attacker access to confidential data or the ability to execute arbitrary code; however, it effectively denies service to legitimate users by disrupting authentication and security policy enforcement.

Detection Methods for CVE-2026-32071

Indicators of Compromise

• Unexpected LSASS process crashes recorded in Windows Event Logs (Event ID 1000/1001 for application crashes)
• System reboots with LSASS-related error messages
• Increased network traffic targeting LSASS-related ports from unknown or suspicious sources
• Multiple authentication failures occurring across domain-joined systems simultaneously

Detection Strategies

• Monitor Windows Event Logs for LSASS process termination events and application error events referencing lsass.exe
• Configure network intrusion detection systems to flag anomalous traffic patterns targeting authentication services
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process behavior associated with LSASS
• Implement SentinelOne's behavioral AI to detect exploitation attempts targeting critical system processes

Monitoring Recommendations

• Enable detailed logging for Windows security events and authentication services
• Configure real-time alerting for any LSASS process crashes or unexpected terminations
• Review network traffic logs for patterns consistent with denial of service attempts against Windows systems
• Establish baseline LSASS process behavior to identify deviations that may indicate attack attempts

How to Mitigate CVE-2026-32071

Immediate Actions Required

• Apply the latest Microsoft security updates addressing CVE-2026-32071 immediately
• Restrict network access to LSASS-related services to trusted IP ranges only
• Ensure perimeter firewalls block unnecessary inbound traffic to Windows authentication services
• Enable Windows Defender Credential Guard where supported to provide additional LSASS protection

Patch Information

Microsoft has released a security update to address this vulnerability. Refer to the Microsoft Security Update Guide for CVE-2026-32071 for specific patch details, affected product versions, and download links. Organizations should prioritize applying this patch to all affected Windows systems, particularly domain controllers and critical infrastructure servers.

Workarounds

• Implement network segmentation to limit exposure of Windows authentication services to untrusted networks
• Use Windows Firewall rules to restrict inbound connections to LSASS-related ports from unauthorized sources
• Consider enabling LSA protection (RunAsPPL) to add additional process protection for LSASS
• Deploy SentinelOne endpoint protection with behavioral AI to detect and block exploitation attempts targeting system processes