CVE-2026-69365: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 21H2

This vulnerability involves an out-of-bounds read in the Microsoft Local Security Authority Server (lsasrv) on Windows 10 Version 21H2. Exploitation requires an authorized attacker to connect over a network, potentially allowing privilege escalation. The issue is tracked as CWE-125. Multiple specific Windows 10 builds are affected, with patches released to address the flaw. Microsoft has published an official advisory and provided an official fix.

Successful exploitation can result in elevation of privileges, allowing an attacker with authorized network access to gain higher-level permissions on the affected system. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69365 to remediate this vulnerability.