CVE-2026-112807

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to deny service over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1128086.5Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attackerCVE-2026-1128095.5Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally.CVE-2026-112815.0Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive iCVE-2026-1128107.0Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileCVE-2026-1128117.8Stack-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1128127.0Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.CVE-2026-1128134.7Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized aCVE-2026-1128145.5Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.CVE-2026-11281610.0Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allCVE-2026-112829.6Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially performCVE-2026-1128208.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes AcadeCVE-2026-1128216.5Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.Th
CVE-2026-112807: Medium severity, CVSS 6.5 | Vulnix