CVE-2026-62758: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-62758 Overview

CVE-2026-62758 is a heap-based buffer overflow [CWE-122] in the Windows Remote Access Connection Manager (RasMan) service. An authenticated local attacker can corrupt heap memory to elevate privileges on the affected host. Microsoft published the advisory on 2026-08-11, and the flaw affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025.

Successful exploitation yields high impact to confidentiality, integrity, and availability. The attack requires local access and low privileges, with no user interaction.

Critical Impact
A local attacker with standard user rights can elevate to SYSTEM by triggering a heap overflow in the RasMan service, gaining full control of the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62758 published to NVD
2026-08-11 - Microsoft releases security update for CVE-2026-62758
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62758

Vulnerability Analysis

The Remote Access Connection Manager (rasmans.dll), running under the svchost.exe process context, manages dial-up and VPN connections on Windows. The service exposes RPC interfaces reachable by local authenticated users. A heap-based buffer overflow [CWE-122] in one of these code paths allows an attacker to write beyond an allocated heap chunk.

Because RasMan runs with SYSTEM privileges, controlled corruption of adjacent heap structures leads to local privilege escalation. The flaw is classified as an elevation of privilege vulnerability with no user interaction required.

Root Cause

The root cause is inadequate bounds checking on attacker-influenced input processed by the RasMan service. When the service allocates a heap buffer for connection or configuration data, subsequent copy operations do not correctly validate the destination size against the source length. This mismatch enables an out-of-bounds write on the process heap.

Attack Vector

Exploitation requires local access and an authenticated session on the target host. The attacker interacts with the RasMan RPC surface from a low-privilege process. By shaping heap allocations and then triggering the vulnerable code path, the attacker overwrites adjacent objects to hijack control flow or corrupt security-relevant state inside the SYSTEM-level service.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide entry for CVE-2026-62758 for authoritative technical details.

Detection Methods for CVE-2026-62758

Indicators of Compromise

Unexpected crashes or restarts of the RasMan service or the hosting svchost.exe instance, visible in Windows Event Log under Application and System channels.
Werfault or WER crash reports referencing rasmans.dll with heap corruption exception codes such as 0xC0000374 or 0xC0000005.
Creation of new SYSTEM-context processes spawned as children of the RasMan svchost.exe shortly after user-initiated RPC activity.

Detection Strategies

Hunt for local processes making RPC calls to the RasMan interface followed by service crashes or privilege transitions to SYSTEM.
Correlate abnormal loads or reflective handling of rasapi32.dll and rasmans.dll from non-standard binaries or user sessions.
Flag standard-user processes that suddenly interact with NT AUTHORITY\SYSTEM tokens after touching RasMan endpoints.

Monitoring Recommendations

Enable Windows Defender exploit protection and heap integrity checks for svchost.exe instances hosting RasMan.
Forward Sysmon Event IDs 1 (process create), 7 (image load), and 10 (process access) plus Windows service crash events to a central analytics platform.
Baseline expected RasMan activity per host and alert on deviations, particularly on servers where dial-up and VPN client roles are not in use.

How to Mitigate CVE-2026-62758

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62758 to all affected Windows client and server systems.
Prioritize multi-user systems, jump hosts, and Remote Desktop Session Hosts where local low-privilege access is common.
Audit local account inventories and remove unused interactive accounts that could be used to reach the RasMan interface.

Patch Information

Microsoft addresses CVE-2026-62758 through cumulative and monthly rollup updates published on 2026-08-11 for all supported Windows versions listed above. Refer to the Microsoft Security Update Guide for the specific KB article and package for each build. Legacy Windows Server 2012 and 2012 R2 fixes are delivered through the Extended Security Update channel.

Workarounds

Where dial-up and VPN client connections are not required, set the RasMan service Start value to 4 (disabled) and stop the service.
Restrict local logon rights through Group Policy so that only administrative users can obtain interactive sessions on servers.
Apply application control policies to block untrusted binaries from executing on hosts pending patch deployment.

bash

# Disable the Remote Access Connection Manager service on hosts that do not need it
sc.exe config RasMan start= disabled
sc.exe stop RasMan

# Verify current state
sc.exe query RasMan