CVE-2026-62730 Overview
CVE-2026-62730 is a buffer over-read vulnerability in the Windows Wired AutoConfig Service (dot3svc). The flaw allows an authorized local attacker to read memory beyond an allocated buffer, resulting in information disclosure. The issue is tracked under CWE-126: Buffer Over-read and affects a wide range of supported Windows client and server versions. Exploitation requires local access and low privileges, but no user interaction. Successful exploitation impacts confidentiality only; integrity and availability are unaffected. Microsoft published guidance in the Microsoft Security Update Guide.
Critical Impact
An authenticated local attacker can read out-of-bounds memory from the Wired AutoConfig Service to disclose sensitive process data, including potential credentials or configuration secrets handled by 802.1X wired authentication.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62730 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62730
Vulnerability Analysis
The Wired AutoConfig Service (dot3svc) manages IEEE 802.1X authentication for wired Ethernet interfaces on Windows. It parses configuration profiles, EAP payloads, and network state structures received through local RPC interfaces and system APIs. CVE-2026-62730 arises when the service reads past the end of a bounded buffer while processing one of these structures. An authorized local attacker who can send crafted input to the service triggers the over-read and receives residual process memory in the response or in observable side effects. Because dot3svc runs with elevated service privileges, the leaked memory can contain sensitive material outside the caller's normal trust boundary.
Root Cause
The root cause is classified as CWE-126: Buffer Over-read. The service reads a length or index value from attacker-influenced input without validating it against the actual size of the underlying buffer. When the parser advances beyond the allocated region, adjacent heap or stack memory is returned to the caller.
Attack Vector
The attack vector is local and requires an authenticated user context. No user interaction is needed. The attacker interacts with the Wired AutoConfig Service through its exposed interfaces on the local system and supplies a malformed request that triggers the over-read. The result is disclosure of memory contents to the attacker's process. Verified public exploit code is not available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code has been published. See the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2026-62730
Indicators of Compromise
- Unexpected local processes issuing repeated RPC calls or configuration requests to the Wired AutoConfig Service (dot3svc).
- Abnormal crash or hang events for svchost.exe instances hosting dot3svc, recorded in the Windows Application and System event logs.
- Non-administrative users querying or manipulating 802.1X wired profiles outside of provisioning workflows.
Detection Strategies
- Monitor process creation and command-line telemetry for tools such as netsh lan, wevtutil, or custom binaries interacting with dot3svc from standard user accounts.
- Alert on unusual local RPC traffic to the Wired AutoConfig Service endpoints from non-system, non-administrative principals.
- Correlate service crash events for dot3svc with the invoking user and parent process to identify probing behavior.
Monitoring Recommendations
- Ingest Windows Security, System, and Application event logs into a central analytics platform and retain them for baseline comparisons.
- Track patch state for CVE-2026-62730 across all Windows 10, Windows 11, and Windows Server hosts to prioritize unpatched systems.
- Baseline normal use of 802.1X wired configuration commands per host, then alert on deviations from that baseline.
How to Mitigate CVE-2026-62730
Immediate Actions Required
- Apply the security updates referenced in the Microsoft Security Update Guide for every affected Windows client and server SKU.
- Prioritize patching on multi-user systems, jump hosts, and shared workstations where local low-privilege access is common.
- Restrict interactive and remote desktop access on sensitive hosts to reduce the population of users able to trigger a local attack.
Patch Information
Microsoft has issued fixes as part of its regular security update cycle. Refer to the Microsoft Security Update Guide entry for CVE-2026-62730 for the specific KB article that applies to each supported version of Windows 10, Windows 11, and Windows Server. Confirm installation by verifying the KB in Get-HotFix output or via your patch management console.
Workarounds
- Where 802.1X wired authentication is not required, set the Wired AutoConfig Service (dot3svc) startup type to Disabled to remove the attack surface.
- Enforce the principle of least privilege so that only trusted users hold interactive logon rights on affected hosts.
- Use application control policies to block untrusted local binaries that could be used to probe the service.
# Configuration example: disable the Wired AutoConfig Service where 802.1X wired auth is not used
sc.exe config dot3svc start= disabled
sc.exe stop dot3svc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
