CVE-2026-62702: Windows 10 21h2 DOS Vulnerability

CVE-2026-62702 Overview

CVE-2026-62702 is a null pointer dereference vulnerability in the Windows Graphics Kernel. The flaw allows an unauthenticated remote attacker to trigger a denial-of-service condition against affected Windows systems over a network. The issue is tracked under CWE-476 (NULL Pointer Dereference) and affects a broad range of client and server Windows versions. Microsoft published the advisory in its Security Update Guide. No public proof-of-concept, exploitation activity, or CISA KEV entry exists at the time of publication.

Critical Impact
An unauthenticated network attacker can crash the Windows Graphics Kernel and disrupt availability across affected client and server Windows builds.

Affected Products

Microsoft Windows 10 21H2 and 22H2 (x86, x64, ARM64)
Microsoft Windows 11 23H2, 24H2, 25H2, and 26H1 (x64, ARM64)
Microsoft Windows Server 2022 and Windows Server 2025

Discovery Timeline

2026-08-11 - CVE-2026-62702 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62702

Vulnerability Analysis

The vulnerability resides in the Windows Graphics Kernel, a kernel-mode component that services graphics and rendering requests on behalf of user-mode callers and other kernel subsystems. A code path within the component dereferences a pointer without first validating that it is non-null. When the pointer is null at the moment of use, the kernel raises an unhandled access violation. The resulting bug check terminates the affected system.

Because the attack vector is network-based and requires no privileges or user interaction, an attacker only needs the ability to reach a network-exposed service that ultimately reaches the vulnerable code path in the Graphics Kernel. Successful exploitation impacts availability only. Confidentiality and integrity are not affected. The scope is marked as changed, indicating the crash affects components beyond the vulnerable component's security authority.

Root Cause

The root cause is missing validation of a pointer before dereference inside the Windows Graphics Kernel [CWE-476]. Specific object or handle state, when reached over a network-facing code path, produces a null value that the function assumes is initialized. Microsoft has not published deeper technical details on the specific structure or function involved.

Attack Vector

An unauthenticated attacker sends crafted input over the network to a service that reaches the vulnerable Graphics Kernel path. Delivery mechanisms consistent with prior Graphics Kernel bugs include remote desktop, print, and rendering paths that marshal client-supplied graphics data into the kernel. Reaching the sink does not require credentials or user action on the target.

No verified public exploit code is available. See the Microsoft Security Update Guide entry for CVE-2026-62702 for vendor guidance.

Detection Methods for CVE-2026-62702

Indicators of Compromise

Unexpected BugCheck events (Event ID 1001) in the System log referencing graphics-related stop codes such as VIDEO_TDR_FAILURE, SYSTEM_SERVICE_EXCEPTION, or PAGE_FAULT_IN_NONPAGED_AREA with a faulting module in the graphics kernel stack.
Repeated unplanned reboots or Windows Error Reporting (WER) crash dumps generated on hosts exposed to untrusted networks.
Spikes in inbound traffic to services that render or transmit graphics data immediately preceding a system crash.

Detection Strategies

Correlate kernel crash telemetry with network flow data to identify hosts that crashed shortly after receiving traffic from external or untrusted sources.
Alert on Windows Event IDs 41 (unexpected shutdown), 1001 (bug check), and 6008 (unexpected shutdown) occurring in clusters across multiple endpoints or servers.
Hunt for repeated connection patterns from a single source that precede crash events on multiple hosts, which is characteristic of network-triggered DoS attempts.

Monitoring Recommendations

Ingest Windows System and Application event logs, WER minidumps, and network flow logs into a centralized analytics platform for cross-source correlation.
Monitor patch compliance for the August 2026 Windows security update across all affected builds listed above.
Track availability metrics on internet-facing Windows servers, especially Windows Server 2022 and Windows Server 2025, for anomalous restart rates.

How to Mitigate CVE-2026-62702

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62702 to all affected Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems.
Prioritize patching for internet-facing servers and any host running network services that process graphics or rendering data.
Verify that automated patch deployment tooling has coverage for all listed builds, including 25H2 and 26H1 client versions and both x64 and ARM64 architectures.

Patch Information

Microsoft addresses CVE-2026-62702 through cumulative updates delivered via Windows Update, Windows Server Update Services (WSUS), and Microsoft Update Catalog. Refer to the Microsoft Security Update Guide for the specific KB identifiers associated with each affected build. After installation, confirm the update is present using Get-HotFix or the Settings update history view and reboot as required.

Workarounds

Restrict network access to affected hosts using host-based and perimeter firewalls, limiting exposure to only trusted management networks until patches are applied.
Disable or gate network-exposed services that route graphics content into the kernel where those services are not required.
Segment Windows Server 2022 and Windows Server 2025 systems from untrusted networks and enforce authentication at the network edge where feasible.

bash

# Verify installation of the Microsoft security update on Windows
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Restrict inbound access on a Windows host to a management subnet (example)
New-NetFirewallRule -DisplayName "Block-Untrusted-Inbound" -Direction Inbound -Action Block -RemoteAddress Any
New-NetFirewallRule -DisplayName "Allow-Mgmt-Inbound" -Direction Inbound -Action Allow -RemoteAddress 10.10.0.0/24