CVE-2026-62752: Windows 10 1607 Privilege Escalation Bug

CVE-2026-62752 Overview

CVE-2026-62752 is a heap-based buffer overflow [CWE-122] in the Windows Kerberos authentication component. An authorized local attacker can trigger the overflow to elevate privileges on the affected host. The flaw affects a wide range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2012 through 2025.

Microsoft published the advisory on 2026-08-11 and assigned it a CVSS 3.1 base score of 7.8. The EPSS probability is 0.318% with a percentile of 24.447 as of 2026-08-13. No public proof-of-concept exploit or in-the-wild exploitation has been reported.

Critical Impact
Successful exploitation grants an authenticated local attacker high confidentiality, integrity, and availability impact, effectively enabling privilege escalation to SYSTEM on the affected Windows host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 builds
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 builds
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62752 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62752

Vulnerability Analysis

The vulnerability resides in Windows Kerberos, the operating system's implementation of the Kerberos authentication protocol. A heap-based buffer overflow [CWE-122] occurs when the component writes beyond the bounds of a dynamically allocated buffer on the process heap. An authorized local attacker can supply crafted authentication data that causes the overflow.

Because Kerberos runs within privileged security processes on Windows, corrupting heap memory in this component can lead to control-flow hijacking or corruption of adjacent security-relevant structures. Exploitation results in elevation of privilege from a standard user context to a higher-privileged context on the same machine.

Root Cause

The root cause is improper validation of the length or structure of attacker-controlled input processed by the Kerberos component. When the component copies this input into a heap buffer without adequate size checks, it overwrites adjacent heap memory. This class of flaw enables corruption of function pointers, object headers, or security tokens residing on the heap.

Attack Vector

The attack vector is local and requires low privileges with no user interaction. An attacker must already have the ability to execute code on the target as an authenticated user, for example through a standard interactive session, a compromised service account, or an initial-access foothold. The attacker then invokes the vulnerable Kerberos code path with malformed data to trigger the overflow and pivot to SYSTEM-level access. No verified public exploit code is available at the time of writing; refer to the Microsoft Security Update CVE-2026-62752 advisory for authoritative technical details.

Detection Methods for CVE-2026-62752

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries involving lsass.exe or Kerberos-related modules such as kerberos.dll and kdcsvc.dll
New processes spawned as NT AUTHORITY\SYSTEM from a parent process running under a standard user account
Anomalous local Kerberos ticket requests immediately followed by privilege changes on the same host

Detection Strategies

Monitor for heap corruption crash signatures in lsass.exe and correlate with the user session that triggered them
Alert on token manipulation or privilege elevation events (Windows Security Event IDs 4672 and 4673) originating from non-administrative users
Track process lineage where low-privileged users produce SYSTEM-level child processes shortly after Kerberos activity

Monitoring Recommendations

Ingest Sysmon, Windows Security, and LSASS crash telemetry into a central analytics platform to correlate local Kerberos anomalies
Baseline normal Kerberos client behavior per host and flag deviations such as repeated malformed authentication requests
Prioritize monitoring on domain controllers and Tier 0 assets where Kerberos exploitation impact is highest

How to Mitigate CVE-2026-62752

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62752 advisory to all affected Windows client and server builds
Prioritize patching of domain controllers, jump hosts, and multi-user systems where local attackers can most readily reach the vulnerable code path
Audit local and interactive logon rights and remove unnecessary standard user access to sensitive servers

Patch Information

Microsoft has published fixes through the Security Update Guide entry Microsoft Security Update CVE-2026-62752. Cumulative updates for the listed Windows 10, Windows 11, and Windows Server versions address the heap-based buffer overflow in the Kerberos component. Verify deployment via wmic qfe list or your patch management platform after installation.

Workarounds

No vendor-supplied workaround is listed; patching is the supported remediation path
Reduce local attack surface by enforcing least privilege, restricting interactive logon on servers, and disabling unused accounts
Enable Credential Guard and Protected Process Light for LSASS where supported to constrain post-exploitation activity

bash

# Verify installation of the Microsoft security update on Windows
# Replace KBNNNNNNN with the specific KB identifier listed in the MSRC advisory
wmic qfe list brief | findstr /I "KBNNNNNNN"

# PowerShell equivalent
Get-HotFix | Where-Object { $_.HotFixID -eq "KBNNNNNNN" }