This vulnerability (CVE-2026-20854) involves a use-after-free condition in the LSASS component of Microsoft Windows 11 Version 24H2 (build 10.0.26100.0). Exploitation requires an attacker with some level of authorization and network access. Successful exploitation could lead to remote code execution with high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

An authorized attacker can exploit this use-after-free vulnerability remotely to execute arbitrary code on the affected system. This can result in full compromise of system confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20854 to remediate this vulnerability.