Windows LSASS RCE/LPE. A heap overflow in lsasrv.dll, reachable from through a single LSARPC call. Which might turn into PostAuth RCE. Reported to MSRC last Friday (Aug 7), still in repro phase; patched today (Aug 12) in CVE-2026-62784(maybe), Other researchers reported it much earlier. The bug： While reversing the AEAD-encrypted LSA secret plumbing in lsasrv.dll, the decrypted plaintext header { u16 Length; u16 MaxLen; data... } is passed straight into an allocation + copy with no cross-validation: pv = LocalAlloc(LMEM_ZEROINIT, MaxLen + 16); // attacker-chosen size memcpy(pv + 8, plaintext + 4, Length); // no Length <= MaxLen check Both size fields are attacker-controlled and mutually unconstrained. The AEAD integrity check (HMAC-SHA512) authenticates the ciphertext — it says nothing about the semantics of the decoded size fields. Reachability. The entry point is LSARPC opnum 136, LsarOpenSecret2. The secret-name decryption runs before the object/access check, so no rights on the target secret are required. And since the local LRPC session key is the well-known constant "SystemLibraryDTC", the caller fully controls the plaintext and hence both size fields. Length = 0xFFFC, MaxLen = 0 → a 16-byte allocation followed by a ~64 KB copy → guaranteed lsass heap corruption → CRITICAL_PROCESS_DIED → bugcheck → reboot.
Post summary
The post details a newly disclosed LSASS heap‑overflow vulnerability in lsasrv.dll that can lead to crashes, and notes that Microsoft released a patch on Aug 12.
