CVE-2011-0039
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and...
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."
- Record
CVE-2011-0039- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."
- Record
CVE-2011-0039- Updated
- 2026-11-02
EUVDEUVD-2011-0065 No score
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."
- Record
EUVD-2011-0065- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x6x2-p3pj-7mv4 No score
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and...
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation Vulnerability."
- Record
GHSA-x6x2-p3pj-7mv4- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0039 is a high vulnerability (CVSS 7.2) in Microsoft Windows Xp, published February 9, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 80th percentile. No source names a fixed version.
References
securityfocus.com/bid/46152
secunia.com/advisories/43253
vupen.com/english/advisories/2011/0327
docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-014
securitytracker.com/id?1025049
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12537
nvd.nist.gov/vuln/detail/CVE-2011-0039
github.com/advisories/GHSA-x6x2-p3pj-7mv4