{"id":"CVE-2026-112807","kind":"vulnerability","aliases":["CVE-2026-112807"],"related":[],"title":"Windows LSA Server: heap overflow lets an authorized user crash service remotely","description":"Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to deny service over a network.","summary":"A heap-based buffer overflow in the Microsoft Local Security Authority Server (lsasrv) can be triggered by an authorized attacker over the network. The sources say the result is denial of service, meaning the service can be knocked over.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:44+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","triaged_at":"2026-11-10T19:57:55+00:00","updated_at":"2026-11-10T19:57:55+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-10T19:57:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows LSA Server: heap overflow lets an authorized user crash service remotely","impact":"low","summary":"A heap-based buffer overflow in the Microsoft Local Security Authority Server (lsasrv) can be triggered by an authorized attacker over the network. The sources say the result is denial of service, meaning the service can be knocked over.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","active-directory"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local Security Authority service crashes, causing denial of service over the network","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-112807 for affected Windows builds, fixed updates and whether a non-default configuration is required.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00065,"input_tokens":4510,"output_tokens":397,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112807':15A,18A '-2026':14A,17A 'activ':20B 'active-directori':19B 'allow':75C 'attack':44B,78C 'author':8A,35B,43B,72C,77C 'base':27B,65C 'buffer':28B,66C 'crash':10A 'cve':13A,16A 'deni':80C 'denial':54B 'directori':21B 'heap':4A,26B,64C 'heap-bas':25B,63C 'infrastructur':22B 'knock':62B 'let':6A 'local':33B,70C 'lsa':2A 'lsasrv':37B,74C 'mean':57B 'microsoft':32B,69C 'network':47B,84C 'overflow':5A,29B,67C 'remot':12A 'result':52B 'say':50B 'secur':34B,71C 'server':3A,36B,73C 'servic':11A,56B,59B,81C 'sourc':49B 'trigger':40B 'user':9A 'window':1A,23B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["activedirectory","infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-112807':15A,18A '-2026':14A,17A 'author':8A 'crash':10A 'cve':13A,16A 'heap':4A 'let':6A 'lsa':2A 'overflow':5A 'remot':12A 'server':3A 'servic':11A 'user':9A 'window':1A","search_b":"'activ':20B 'active-directori':19B 'attack':44B 'author':35B,43B 'base':27B 'buffer':28B 'denial':54B 'directori':21B 'heap':26B 'heap-bas':25B 'infrastructur':22B 'knock':62B 'local':33B 'lsasrv':37B 'mean':57B 'microsoft':32B 'network':47B 'overflow':29B 'result':52B 'say':50B 'secur':34B 'server':36B 'servic':56B,59B 'sourc':49B 'trigger':40B 'window':23B","search_c":"'allow':75C 'attack':78C 'author':72C,77C 'base':65C 'buffer':66C 'deni':80C 'heap':64C 'heap-bas':63C 'local':70C 'lsasrv':74C 'microsoft':69C 'network':84C 'overflow':67C 'secur':71C 'server':73C 'servic':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112807","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112807","severity":null,"published_at":"2026-11-10T19:18:44+00:00","modified_at":"2026-11-10T19:18:45+00:00","first_seen_at":"2026-11-10T19:24:34+00:00","fetched_at":"2026-11-10T19:24:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}