CVE-2026-62695: Windows 11 23h2 Privilege Escalation Flaw

CVE-2026-62695 Overview

CVE-2026-62695 is a heap-based buffer overflow vulnerability [CWE-122] in the Windows Storage component. An authorized local attacker can exploit this flaw to elevate privileges on affected Windows 11 and Windows Server systems. Microsoft published the advisory on 2026-08-11 and last updated the record on 2026-08-13.

The vulnerability affects Windows 11 versions 23H2, 24H2, 25H2, and 26H1, along with Windows Server 2022 and Windows Server 2025. Successful exploitation yields full compromise of confidentiality, integrity, and availability on the local host.

Critical Impact
An authenticated attacker with low privileges can trigger a heap overflow in Windows Storage to gain SYSTEM-level privileges, enabling full control of the affected host.

Affected Products

Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2022
Microsoft Windows Server 2025 (x64)

Discovery Timeline

2026-08-11 - CVE-2026-62695 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62695

Vulnerability Analysis

CVE-2026-62695 is a heap-based buffer overflow [CWE-122] in the Windows Storage subsystem. The Windows Storage component handles storage-related operations including volume management, disk I/O, and storage device interaction. An attacker who can execute code locally with standard user rights can send crafted input to the vulnerable code path and write beyond an allocated heap buffer.

Overflowing the heap allocation corrupts adjacent memory structures. Attackers typically use this to overwrite function pointers, object metadata, or heap chunk headers. Controlled corruption in kernel or privileged service memory allows redirection of execution flow, resulting in privilege escalation to SYSTEM.

The attack requires local access and low privileges but no user interaction. The unchanged scope indicates the impact remains within the vulnerable component's security boundary, but that boundary already grants SYSTEM-level access on Windows. The EPSS score of 0.318% reflects low predicted exploitation activity at publication, though local privilege escalation flaws in Windows are frequently weaponized in post-compromise chains.

Root Cause

The root cause is improper validation of buffer size or element count during a heap allocation in Windows Storage. When the vulnerable code path processes attacker-controlled input, it writes more data than the destination buffer can hold. Microsoft has not published detailed root-cause information beyond the CWE-122 classification.

Attack Vector

The attacker must be authenticated on the target system with at least standard user rights. Exploitation typically occurs through interaction with the Windows Storage service via crafted I/O control codes (IOCTLs), device handles, or storage-related APIs. No user interaction from another account is required. The vulnerability is not exploitable remotely across the network.

See the Microsoft Security Update CVE-2026-62695 advisory for vendor-supplied details.

Detection Methods for CVE-2026-62695

Indicators of Compromise

Unexpected crashes or bugchecks in storage.sys, storport.sys, or related Windows Storage driver components
Standard user processes spawning child processes running as NT AUTHORITY\SYSTEM
Anomalous IOCTL traffic to storage device objects from non-administrative user sessions
New services, scheduled tasks, or drivers created shortly after suspicious storage-related activity

Detection Strategies

Monitor Windows Error Reporting (WER) and kernel crash dumps for faults referencing storage driver stacks
Baseline and alert on unusual handle acquisition against \Device\Harddisk* and volume device objects from non-admin users
Correlate local logon events (Event ID 4624 type 2/3) with subsequent privilege token elevation on the same host
Apply behavioral EDR rules that detect user-to-SYSTEM token impersonation immediately following non-privileged process activity

Monitoring Recommendations

Enable Sysmon Event ID 1 (process create) and Event ID 10 (process access) to surface suspicious access to lsass.exe or services.exe from newly elevated processes
Ingest kernel and driver telemetry into a centralized SIEM for correlation across hosts
Track patch compliance for the August 2026 Microsoft security updates across all Windows 11 and Windows Server 2022/2025 endpoints

How to Mitigate CVE-2026-62695

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62695 to all affected systems
Prioritize patching multi-user systems, terminal servers, and shared workstations where local access is broadly available
Restrict interactive and remote logon rights on servers to reduce the pool of accounts able to trigger the flaw
Audit local accounts and remove unnecessary standard user access on sensitive hosts

Patch Information

Microsoft has released a security update addressing CVE-2026-62695. Refer to the Microsoft Security Update CVE-2026-62695 page for the specific KB article and download links matching each affected Windows build. Deploy updates through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management platform.

Workarounds

No official workaround has been published by Microsoft; patching is the required remediation
Reduce the local attack surface by enforcing least-privilege policies and removing standard users from systems that do not require interactive access
Enable attack surface reduction (ASR) rules and tamper protection in Microsoft Defender to limit post-exploitation actions

bash

# Verify installed updates on Windows to confirm remediation
wmic qfe list brief /format:table

# PowerShell equivalent with filtering
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20