CVE-2026-62784 Overview
CVE-2026-62784 is a heap-based buffer overflow [CWE-122] in the Microsoft Local Security Authority Server Service (lsasrv). An authorized attacker can send crafted network requests to a vulnerable Windows host and trigger memory corruption within the lsasrv process. Successful exploitation allows the attacker to execute arbitrary code over the network with the privileges of the affected service.
The flaw affects a broad range of Windows client and server editions, from Windows Server 2012 through Windows Server 2025 and Windows 10 1607 through Windows 11 26H1. Because lsasrv handles authentication and security policy on Windows systems, compromise of this component has direct implications for credential exposure and lateral movement.
Critical Impact
Authenticated attackers can achieve remote code execution inside the Local Security Authority Server Service, enabling credential theft and full system compromise across supported Windows client and server versions.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62784 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62784
Vulnerability Analysis
The vulnerability resides in the Local Security Authority Server Service (lsasrv.dll), the user-mode component responsible for authentication, security policy enforcement, and Security Account Manager (SAM) operations on Windows. A heap-based buffer overflow in this component allows an authenticated remote attacker to corrupt heap memory inside the LSA process and hijack execution.
Because lsasrv runs inside the LSASS process and handles credential material, an attacker who executes code within it gains access to authentication secrets, Kerberos tickets, and NTLM hashes. This makes the vulnerability a strong pivot point for lateral movement in Active Directory environments.
The attack requires network access and low-privilege authentication. No user interaction is needed, and exploitation does not cross a security boundary beyond the compromised host's LSA scope.
Root Cause
The root cause is improper validation of the size or structure of attacker-supplied data before it is copied into a heap-allocated buffer inside lsasrv. When the input exceeds the expected bounds, adjacent heap metadata or object pointers are overwritten. An attacker who controls the overflowing content can steer subsequent allocator or object operations to gain code execution [CWE-122].
Attack Vector
Exploitation occurs over the network against an authenticated session. The attacker first obtains valid, low-privilege credentials, then issues crafted authentication or RPC traffic targeting the LSA service. The malformed request triggers the heap overflow inside lsasrv, allowing arbitrary code execution in the security authority process on the target host. Refer to the Microsoft Security Update CVE-2026-62784 advisory for technical details.
Detection Methods for CVE-2026-62784
Indicators of Compromise
- Unexpected crashes, restarts, or Watson error reports referencing lsass.exe or lsasrv.dll on domain controllers and member servers.
- Anomalous authentication or RPC traffic from low-privilege accounts targeting LSA endpoints (\pipe\lsass, \pipe\netlogon, TCP/445, TCP/135 with dynamic RPC).
- Child processes spawned by lsass.exe or outbound network connections initiated by the LSA process.
Detection Strategies
- Monitor Windows Error Reporting and event IDs 1000/1001 for faults inside lsasrv.dll correlated with remote logon activity.
- Baseline normal RPC and SMB traffic to LSA interfaces, then alert on malformed requests or unusually large payloads from authenticated users.
- Hunt for memory access to lsass.exe from unexpected processes and for suspicious module loads into the LSA process.
Monitoring Recommendations
- Enable Protected Process Light (PPL) for LSA and forward the resulting protection events to your SIEM.
- Ingest Windows Security, Sysmon, and RPC telemetry into a centralized data lake and correlate authentication anomalies with lsass.exe faults.
- Track post-exploitation behaviors such as credential dumping, ticket manipulation, and lateral SMB or WMI activity following any LSA anomaly.
How to Mitigate CVE-2026-62784
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62784 to all affected Windows client and server builds.
- Prioritize patching of domain controllers, certificate authorities, and other identity-critical hosts where LSA compromise has the highest blast radius.
- Rotate credentials, Kerberos krbtgt, and machine account passwords on any system where compromise of lsass.exe is suspected.
Patch Information
Microsoft has released security updates addressing CVE-2026-62784 across Windows 10, Windows 11, and Windows Server 2012 through 2025. Consult the Microsoft Security Update CVE-2026-62784 advisory for the KB article and build numbers corresponding to each supported version.
Workarounds
- Restrict inbound SMB and RPC traffic to management networks and block direct client-to-client access to LSA interfaces where feasible.
- Enforce LSA Protection (RunAsPPL) and Credential Guard to reduce credential theft impact if the LSA process is compromised.
- Remove unnecessary interactive and network logon rights for standard users on servers to reduce the pool of accounts that satisfy the authenticated prerequisite.
# Enable LSA Protection (RunAsPPL) on Windows hosts
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f
# Verify the setting
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL
# Restart required for the protection to take effect
shutdown /r /t 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
