CVE-2026-62738: Windows 10 1607 Information Disclosure

CVE-2026-62738 Overview

CVE-2026-62738 is an out-of-bounds read vulnerability [CWE-125] in Windows Management Instrumentation (WMI). An authorized local attacker can exploit the flaw to disclose sensitive information from process memory. The issue affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025.

Microsoft published the advisory on 2026-08-11 and last updated it on 2026-08-13. The vulnerability requires local access and low-privileged authentication, with no user interaction. It does not directly compromise integrity or availability.

Critical Impact
A local, authenticated attacker can read out-of-bounds memory through WMI, exposing sensitive kernel or process data that may aid further attacks such as privilege escalation.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62738 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62738

Vulnerability Analysis

The vulnerability resides in Windows Management Instrumentation, the core infrastructure Windows uses to expose management data and operations. WMI runs in privileged contexts through the WmiPrvSE.exe provider host and the Winmgmt service. When the affected code path processes attacker-supplied input, it reads memory outside the intended buffer bounds.

The out-of-bounds read [CWE-125] returns data from adjacent memory regions to the caller. This exposes contents that may include pointers, credentials, or other operational data useful for chaining with other vulnerabilities. The confidentiality impact is high, while integrity and availability are unaffected.

Exploitation requires local access and valid low-privilege credentials on the target host. The attack complexity is low, and no user interaction is needed. According to EPSS data from 2026-08-13, the probability of exploitation in the wild remains low.

Root Cause

The root cause is missing or insufficient bounds validation on a buffer processed by a WMI component. When the affected function calculates a read offset or length from attacker-influenced input, it fails to constrain the value against the allocated buffer size. The read then extends past the buffer boundary and returns adjacent memory.

Attack Vector

A local authenticated user invokes WMI through standard interfaces such as wmic.exe, PowerShell cmdlets like Get-WmiObject and Get-CimInstance, or direct calls to IWbemServices. The attacker crafts a query or method invocation whose parameters trigger the vulnerable code path. Memory contents leaked in the response can then be captured for offline analysis.

No public proof-of-concept is available at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2026-62738 advisory for component-level detail.

Detection Methods for CVE-2026-62738

Indicators of Compromise

Unusual WMI queries issued by non-administrative users, particularly against uncommon namespaces or classes.
Elevated volume of WmiPrvSE.exe child processes spawned from user sessions rather than management tooling.
Repeated failed or malformed CIM/WMI method calls in Windows event logs that precede successful queries.

Detection Strategies

Enable and forward the Microsoft-Windows-WMI-Activity/Operational event log, then alert on high-frequency queries from standard user accounts.
Correlate PowerShell script block logging with WMI cmdlet invocations to surface reconnaissance patterns.
Baseline normal WMI consumers per host and flag deviations, especially interactive user sessions issuing management queries.

Monitoring Recommendations

Monitor process creation events (Event ID 4688 / Sysmon Event ID 1) for wmic.exe and PowerShell WMI cmdlets executed by non-admin users.
Track loads of wbemcore.dll and other WMI modules by unexpected processes.
Aggregate telemetry into your SIEM and build detections that link WMI activity to subsequent privilege escalation or credential access behavior.

How to Mitigate CVE-2026-62738

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62738 to all affected Windows client and server systems.
Inventory endpoints against the affected product list and prioritize patching of multi-user systems, jump hosts, and terminal servers.
Restrict interactive and remote logon rights on sensitive systems to reduce the pool of accounts that meet the local, authenticated precondition.

Patch Information

Microsoft has released fixes through the standard security update channel. Consult the Microsoft Security Update CVE-2026-62738 page for the specific KB articles applicable to each affected build. Deploy updates through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager.

Workarounds

Enforce least privilege so standard users cannot invoke WMI against sensitive namespaces; adjust namespace security via wmimgmt.msc.
Constrain PowerShell usage on multi-user systems with Constrained Language Mode and AppLocker or Windows Defender Application Control policies.
Audit and, where feasible, disable remote WMI (DCOM/WinRM) access on hosts that do not require it.

bash

# Configuration example: verify the WMI update is present and audit WMI activity
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
wevtutil sl Microsoft-Windows-WMI-Activity/Operational /e:true
Get-WinEvent -LogName 'Microsoft-Windows-WMI-Activity/Operational' -MaxEvents 100