CVE-2026-20875 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

Api.Msrc.Microsoft • January 13, 2026

Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Windows LSASS Affecting Security Two vulnerabilities have been identified in the Windows Local Security Authority Subsystem Service (LSASS). CVE-2026-20875 allows unauthorized attackers to cause a denial of service, while CVE-2026-20854 enables authorized attackers to execute code remotely. Both vulnerabilities pose significant risks to systems utilizing LSASS. 2 sources 35

Extracted Entities

CVE-2026-20875 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)