CVE-2026-62782: Windows 10 Information Disclosure Flaw

CVE-2026-62782 Overview

CVE-2026-62782 is an out-of-bounds read vulnerability in the Windows Server Message Block (SMB) Client. An unauthenticated remote attacker can exploit this flaw to disclose sensitive information over a network. The vulnerability affects a broad range of Windows client and server editions, including Windows 10, Windows 11, and Windows Server 2016 through 2025. Microsoft classifies this issue as a network-exploitable information disclosure vulnerability requiring no privileges or user interaction. The weakness is tracked under [CWE-125] (Out-of-Bounds Read).

Critical Impact
An unauthenticated attacker can trigger an out-of-bounds read in the Windows SMB Client and disclose memory contents over the network, potentially exposing sensitive data used in authentication or session state.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62782 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62782

Vulnerability Analysis

The vulnerability resides in the Windows SMB Client component, which handles outbound SMB protocol communications with remote file shares. An out-of-bounds read [CWE-125] occurs when the SMB Client processes a malformed or crafted server response and reads beyond the intended memory buffer boundary. The disclosed memory may contain sensitive data such as authentication artifacts, cached credentials, session tokens, or adjacent kernel and process memory. Because the flaw is confidentiality-only, it does not directly permit code execution or modification of data. However, disclosed material can be chained with other techniques to enable authentication relay, session hijacking, or lateral movement.

Root Cause

The root cause is missing or insufficient bounds checking when the SMB Client parses fields returned from a remote SMB server. Attacker-controlled length or offset values in a server response cause the client to read past the end of an allocated buffer. This behavior is consistent with the CWE-125 classification assigned to the CVE.

Attack Vector

Exploitation requires a Windows client to initiate or accept an SMB session with an attacker-controlled server. An attacker typically achieves this by coercing SMB authentication using techniques such as UNC path injection in documents, emails, or web content, or by responding on the local network to broadcast name resolution requests. Once the client connects, the attacker returns crafted SMB response packets that trigger the out-of-bounds read, and memory contents are returned in subsequent protocol traffic.

No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update CVE-2026-62782 for authoritative technical details.

Detection Methods for CVE-2026-62782

Indicators of Compromise

Outbound SMB (TCP/445) connections from workstations to unexpected external or non-corporate IP addresses.
SMB sessions negotiated with servers that return malformed or unusually structured response packets.
Repeated SMB client crashes or Windows Error Reporting events referencing mrxsmb.sys or mrxsmb20.sys.
LLMNR, NBT-NS, or mDNS responses from unauthorized hosts on internal subnets, indicating potential SMB coercion staging.

Detection Strategies

Inspect SMB traffic with network sensors for anomalous response field lengths and offsets that fall outside protocol norms.
Correlate endpoint telemetry showing SMB client processes connecting to non-approved destinations with authentication events.
Hunt for UNC path artifacts (\\attacker\share) embedded in Office documents, LNK files, and email attachments.

Monitoring Recommendations

Enable SMB client auditing and forward events to a centralized logging pipeline for retention and analysis.
Monitor egress firewall logs for TCP/445 and TCP/139 traffic leaving the corporate perimeter.
Alert on new or unusual SMB destinations that were not previously observed in baseline traffic.

How to Mitigate CVE-2026-62782

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62782 advisory to all affected Windows client and server systems.
Block outbound SMB traffic (TCP/445 and TCP/139) at the network perimeter to prevent SMB sessions with untrusted external hosts.
Disable legacy name resolution protocols LLMNR and NBT-NS in Active Directory environments to reduce SMB coercion opportunities.
Prioritize patching for endpoints that regularly interact with external content, such as user workstations and jump hosts.

Patch Information

Microsoft has released security updates for all supported affected products. Consult the Microsoft Security Update CVE-2026-62782 guidance for the specific KB articles and cumulative updates aligned to each Windows version and build.

Workarounds

Enforce SMB signing and require encryption on SMB sessions to reduce the value of any disclosed material.
Restrict outbound SMB via Windows Defender Firewall rules on endpoints that do not require external SMB connectivity.
Use Group Policy to disable the SMB client service on systems that do not need to access remote file shares.

bash

# Block outbound SMB on Windows endpoints via PowerShell
New-NetFirewallRule -DisplayName "Block Outbound SMB 445" `
    -Direction Outbound `
    -Action Block `
    -Protocol TCP `
    -RemotePort 445 `
    -Profile Any

# Disable LLMNR via registry
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" `
    -Name "EnableMulticast" -Value 0 -Type DWord