CVE-2026-62697: Windows Push Notifications UAF Vulnerability

CVE-2026-62697 Overview

CVE-2026-62697 is a use-after-free vulnerability [CWE-416] in the Windows Push Notifications component. An authorized local attacker can exploit the flaw to elevate privileges on the affected system. The issue impacts the confidentiality, integrity, and availability of the target host. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

The vulnerability requires local access and low-privilege authentication but does not require user interaction. Successful exploitation yields elevated privileges, which attackers can chain with initial access techniques to achieve full system compromise.

Critical Impact
A local, authenticated attacker can free and reuse memory in the Windows Push Notifications service to escalate privileges and gain high-integrity code execution on the affected Windows host.

Affected Products

Microsoft Windows (Push Notifications component)
Refer to the Microsoft Security Update CVE-2026-62697 advisory for the full list of affected builds
Vendor-supplied CPE data was not published at the time of writing

Discovery Timeline

2026-09-08 - CVE-2026-62697 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-62697

Vulnerability Analysis

The vulnerability is a use-after-free condition in the Windows Push Notifications component. The component fails to correctly manage the lifetime of an object in memory. Code paths continue to reference the object after it has been freed, allowing an attacker to control the contents of the reused allocation.

Exploitation requires local access to the target and valid low-privilege credentials. No user interaction is needed, and the attack executes entirely within the scope of the vulnerable process. A successful exploit results in code execution at a higher privilege level than the attacker started with.

Root Cause

The root cause is improper object lifetime management in the Windows Push Notifications service, classified as [CWE-416] Use After Free. A pointer to freed memory remains reachable, and subsequent operations dereference it. Attackers with the ability to influence heap allocations can place controlled data into the freed region and hijack the execution path when the stale reference is used.

Attack Vector

The attack vector is local. An attacker who already holds a low-privilege account on the Windows host triggers the vulnerable code path in the Push Notifications service. The attacker then grooms the heap so that a controlled allocation replaces the freed object. When the service dereferences the stale pointer, the attacker gains code execution in the context of the higher-privileged service, resulting in local privilege escalation.

No public proof-of-concept exploit was available at the time of publication. Refer to the Microsoft Security Update CVE-2026-62697 advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-62697

Indicators of Compromise

Unexpected child processes spawned by the Windows Push Notifications service (WpnUserService / WpnService) running with elevated tokens
Crashes or exceptions logged for the Push Notifications service in the Windows Application event log, particularly access violations that may indicate exploitation attempts
New or modified persistence artifacts created shortly after Push Notifications service activity by a non-administrative user

Detection Strategies

Hunt for token elevation events where the parent process belongs to the Push Notifications service but the child process runs under a higher-integrity context
Correlate service crash telemetry with subsequent local logon or privilege change events on the same host within a short time window
Monitor for unusual heap-spray patterns or high-frequency allocation activity targeting the Push Notifications service from a low-privileged user session

Monitoring Recommendations

Enable Windows Error Reporting and forward crash dumps of the Push Notifications service to a central location for triage
Ingest Sysmon Event ID 1 (process creation) and Event ID 10 (process access) into your SIEM and alert on anomalous access to the Push Notifications service
Track patch compliance for the Microsoft security update associated with CVE-2026-62697 across the endpoint fleet

How to Mitigate CVE-2026-62697

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62697 advisory to all affected Windows systems
Prioritize patching on multi-user hosts, terminal servers, and any endpoint where untrusted users can obtain interactive logon
Audit local accounts and remove unnecessary interactive logon rights to reduce the population of users who meet the low-privilege exploitation prerequisite

Patch Information

Microsoft has released a security update addressing CVE-2026-62697. Consult the Microsoft Security Update CVE-2026-62697 advisory for the specific KB articles, affected builds, and download links applicable to your Windows version. Deploy the update through Windows Update, Windows Server Update Services (WSUS), or your standard patch management pipeline.

Workarounds

No official vendor workaround was published; the security update is the supported remediation
Restrict interactive and remote desktop logon to trusted administrators on high-value hosts until the patch is deployed
Enforce application allow-listing and least-privilege policies to limit an attacker's ability to run exploitation tooling on the endpoint

bash

# Verify patch deployment status on a Windows host using PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20