Product:
Windows Local Security Authority Subsystem Service
Summary
Use after free in Windows Local Security Authority Subsystem Service allows an authorized attacker to execute code over a network. This vulnerability can lead to significant security risks if exploited. Attackers can leverage this flaw to gain unauthorized access and control over affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2026-20854 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the network. By sending specially crafted requests to the Windows Local Security Authority Subsystem Service, the attacker can trigger the use after free condition, allowing them to execute arbitrary code on the affected system. This can lead to full system compromise if successful.
Affected Products
- Windows Local Security Authority Subsystem Service: Vulnerable to use after free, allowing code execution over a network.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, monitoring network traffic for unusual activity and implementing strict access controls can help reduce the risk of exploitation.