# CVE-2026-50378 — Windows Key Guard `lsaiso.exe` Unsynchronized `_BCRYPT_ISO_OBJECT` in the BCryptIum Trustlet RPC → Race Condition

---

## Summary

| | |
|---|---|
| **Product** | Windows — `lsaiso.exe` (Isolated LSA / Key Guard trustlet; VBS/IUM VTL1) |
| **CVE ID** | CVE-2026-50378 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-362: Race Condition (improper synchronization of a shared resource) |
| **Delivery** | Local — concurrent BCryptIum crypto-RPC calls to the Key Guard trustlet |
| **KB / Fixed build** | KB5101650 — `lsaiso.exe` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `lsaiso.exe` 10.0.26100.8737 — SHA256 `f4ab2a48426d696b59cdce963780607429848617c4d9b3c2bf8d68c4d1a8d0c0` |
| **Post-patch binary** | `lsaiso.exe` 10.0.26100.8875 — SHA256 `2a93f78621cc9ada373d94412fe78fa3f299e91a866b6518b7434e17b41b2109` |
| **Feature flag** | none — direct fix (not CFR-gated) |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`lsaiso.exe` is the **Isolated LSA / Key Guard** trustlet, which runs in a
Virtualization-Based Security isolated user-mode environment (IUM / VTL1) and
protects credential and key material. It exposes a `BCryptIum*` RPC interface for
isolated cryptographic operations (encrypt/decrypt, key derivation, secret
agreement, claim creation, key import/export, etc.). Each key or context is
represented by a trustlet-side `_BCRYPT_ISO_OBJECT`, looked up per call
(`LookupBCryptIsoObject`).

---

## Vulnerability Summary

Pre-patch, access to a shared `_BCRYPT_ISO_OBJECT` across the `BCryptIum` operations
was **not synchronized**. Two concurrent RPC calls referencing the same object could
run at once, so one call could use, modify, or tear down the object while another was
still using it — a race condition on a shared trustlet crypto object (CWE-362).
Because the object lives inside the Key Guard trustlet and the RPC interface is
reachable by a local caller, winning the race corrupts isolated crypto state and is
exploitable for local elevation of privilege to SYSTEM (per the MSRC FAQ).

> Scope note: this July update reworks the whole `BCryptIum` trustlet interface
> (~36 functions). The CWE-362 fix isolated here is the added per-object SRW-lock
> serialization. The paired Key Guard advisory **CVE-2026-50303** (CWE-1240, use of a
> risky cryptographic primitive) resides in the same binary, but its distinct
> cryptographic change was not cleanly isolable in this diff and is **not** claimed in
> this analysis.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): issue `BCryptIum` crypto-RPC calls
  to the Key Guard trustlet.
- Drive two operations concurrently against the same `_BCRYPT_ISO_OBJECT`.
- Result: unsynchronized concurrent access corrupts the shared trustlet object.

---

## Vulnerability Details

### Root Cause

The trustlet-side `_BCRYPT_ISO_OBJECT` had no per-object lock, so concurrent
`BCryptIum` operations on the same object were not serialized.

### The patch (confirmed — diff, .8737 → .8875)

The `_BCRYPT_ISO_OBJECT` now carries a **per-object SRW lock** (a lock field at
object offset `+0x28`). `AllocateBCryptIsoObject` initializes it, and the `BCryptIum`
operations acquire it around access to the shared object:

```c
// AllocateBCryptIsoObject (10.0.26100.8875) — PATCHED (from our diff)
_BCRYPT_ISO_OBJECT *SRWLock;
...
SRWLock = p_Var1 + 0x28;                 // per-object SRW lock field
// operations (Encrypt/Decrypt/DeriveKey/CreateClaim/DuplicateKey/DestroyKey/...):
AcquireSRWLockExclusive((PSRWLOCK)(obj + 0x28));
// ... use the object ...
ReleaseSRWLockExclusive((PSRWLOCK)(obj + 0x28));
```

`AcquireSRWLockExclusive` / `ReleaseSRWLockExclusive` are newly imported and used
across the `BCryptIum` handlers (which look the object up via `LookupBCryptIsoObject`
and then take the lock), serializing concurrent operations on the same object and
closing the race.

### Patch Completeness Assessment

Fixed in `lsaiso.exe` 10.0.26100.8875 (July 2026). Apply KB5101650. The serialization
runs unconditionally (no feature flag to verify).

---

## Detection Guidance

**Behavioural.** Bursts of concurrent Key Guard `BCryptIum` crypto-RPC calls
referencing the same key/context; trustlet crashes / crypto-state anomalies from
`lsaiso!BCryptIum*` on unpatched builds. (Trustlet internals are largely opaque to
host-side monitoring by design.)

---

## References

- MSRC advisory — CVE-2026-50378 (Windows Key Guard Elevation of Privilege), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/lsaiso_exe-cve-2026-50378-ghidriff.md`
- Paired same-binary Key Guard advisory (not analyzed here): CVE-2026-50303.