CVE-2026-40378: Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Other sources
Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2269Patch KB5095051 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9339Patch KB5099535 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.26226Patch KB5099445 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.23291Patch KB5099444 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33158Patch KB5099536 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.8875Patch KB5101650 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7376Patch KB5099414 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.8875Patch KB5101650 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.7548Patch KB5099539 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7548Patch KB5099539 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9020Patch KB5099538 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5386Patch KB5099540 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.2525Patch KB5101649
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40378?
CVE-2026-40378 has a high severity rating of 7.5.
How can I fix CVE-2026-40378?
To mitigate CVE-2026-40378, apply the latest security updates provided by Microsoft for your affected Windows versions.
What systems are affected by CVE-2026-40378?
CVE-2026-40378 affects Microsoft Windows 10, Windows 11, and several versions of Windows Server.
What type of vulnerability is CVE-2026-40378?
CVE-2026-40378 is a Denial of Service vulnerability linked to memory allocation in the LSASS.
Can CVE-2026-40378 be exploited remotely?
Yes, CVE-2026-40378 can be exploited over a network by an unauthorized attacker.