CVE-2026-40378: Windows 10 1607 LSASS DoS Vulnerability

CVE-2026-40378 Overview

CVE-2026-40378 is a network-exploitable denial of service vulnerability in the Windows Local Security Authority Subsystem Service (LSASS). The flaw stems from memory allocation with an excessive size value [CWE-789], allowing an unauthenticated remote attacker to exhaust system memory and crash the LSASS process. When LSASS terminates unexpectedly, the affected Windows host typically requires a restart, disrupting authentication services across the environment.

Microsoft has confirmed the issue affects Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. No authentication or user interaction is required to trigger the condition.

Critical Impact
Unauthenticated attackers can remotely crash LSASS, disrupting authentication and forcing system restarts across domain controllers and member servers.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-40378 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-40378

Vulnerability Analysis

The Local Security Authority Subsystem Service (lsass.exe) enforces the security policy on Windows systems. It handles user logons, password changes, access token generation, and Kerberos and NTLM authentication traffic. Because LSASS is reachable over the network as part of standard authentication flows, remote clients can send crafted messages that influence internal memory allocation decisions.

CVE-2026-40378 is classified as CWE-789: Memory Allocation with Excessive Size Value. LSASS accepts a size value derived from attacker-controlled network input and passes it to an allocation routine without adequate bounds checking. When the requested size approaches or exceeds available memory, the allocation either fails in a way that terminates the process or drives the host into a resource-exhausted state.

Since LSASS is a protected critical system process, its termination triggers a system restart on most Windows configurations. Repeated exploitation can therefore keep authentication services offline.

Root Cause

The root cause is missing or insufficient validation of a length or count field parsed from a network request handled by LSASS. The service uses the untrusted value directly as the size argument to a heap allocation, permitting allocations far larger than any legitimate authentication payload requires.

Attack Vector

An unauthenticated attacker with network reachability to an affected Windows host sends a specially crafted authentication-related request to LSASS. The request contains a manipulated length field that causes LSASS to attempt an oversized memory allocation. The resulting failure crashes the service and, by extension, the host.

No verified public proof-of-concept exploit is available at publication time. Refer to the Microsoft CVE-2026-40378 Advisory for authoritative technical details.

Detection Methods for CVE-2026-40378

Indicators of Compromise

Unexpected termination of lsass.exe recorded in Windows Event Log (Event ID 1000 or 1001 referencing lsass.exe).
Unscheduled system reboots on domain controllers or authentication servers logged as Event ID 1074 or 6008.
Spikes in inbound authentication traffic (SMB, RPC, Kerberos, or NTLM) from a single source preceding LSASS failures.
Sudden memory pressure or commit charge escalation on the LSASS process prior to crash.

Detection Strategies

Alert on any crash or abnormal exit of lsass.exe, which is never expected during normal operation.
Correlate LSASS termination events with preceding network connections to authentication ports (445, 88, 135, 389).
Monitor for repeated authentication protocol errors originating from the same remote source within short intervals.

Monitoring Recommendations

Enable Windows Security auditing for process termination events (Event ID 4689) filtered on lsass.exe.
Forward Sysmon Event ID 5 (process terminated) and Event ID 3 (network connection) to a centralized SIEM for correlation.
Track LSASS working set and private bytes counters through performance monitoring, alerting on rapid growth.

How to Mitigate CVE-2026-40378

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-40378 across all affected Windows client and server SKUs.
Prioritize patching of domain controllers, Active Directory Federation Services hosts, and any internet-facing Windows systems.
Review perimeter and internal firewall rules to restrict exposure of LSASS-related ports (SMB, RPC, Kerberos) to only required source networks.

Patch Information

Microsoft has released security updates addressing CVE-2026-40378 for all supported Windows versions listed in the advisory. Administrators should consult the Microsoft CVE-2026-40378 Advisory to identify the specific KB article and update package for each operating system version and architecture in their environment. Apply updates through Windows Update, WSUS, Microsoft Endpoint Configuration Manager, or Intune according to standard change management procedures.

Workarounds

Restrict inbound access to TCP 445, 135, 139, and 88 using host-based firewalls or network segmentation where patching is delayed.
Require SMB signing and enforce Kerberos armoring to reduce unauthenticated protocol exposure.
Deploy IPS or WAF signatures capable of dropping malformed authentication requests targeting LSASS.
Increase monitoring frequency for LSASS process health on unpatched hosts and prepare automated restart procedures.

bash

# Example: Restrict inbound SMB access on a Windows host using PowerShell
New-NetFirewallRule -DisplayName "Restrict SMB Inbound" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 445 `
  -RemoteAddress 10.0.0.0/8 `
  -Action Allow

New-NetFirewallRule -DisplayName "Block SMB from Untrusted" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 445 `
  -Action Block