CVE-2026-32071
Published: 14 April 2026
Summary
CVE-2026-32071 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the null pointer dereference vulnerability in LSASS by applying Microsoft patches as referenced in the update guide.
Denial-of-service protection implements safeguards at network entry points to block remote exploitation attempts causing LSASS crashes.
Error handling ensures graceful management of null pointer errors in LSASS to mitigate crashes from invalid memory access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Null pointer dereference in LSASS directly enables remote exploitation to crash the service, mapping to application/system exploitation for endpoint denial of service with no other impacts.
NVD Description
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Deeper analysisAI
CVE-2026-32071 is a null pointer dereference vulnerability, classified under CWE-476, in the Windows Local Security Authority Subsystem Service (LSASS). Published on 2026-04-14, it affects Windows systems running LSASS, a critical component handling authentication and security policy enforcement.
The vulnerability enables an unauthorized attacker to exploit it remotely over a network with low attack complexity, requiring no privileges, no user interaction, and no change in scope. Successful exploitation results in a denial of service, achieving high impact on availability (A:H) while having no impact on confidentiality or integrity, as reflected in its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Microsoft has published an update guide for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32071, which security practitioners should consult for patch availability and mitigation recommendations.
Details
- CWE(s)