CVE-2026-62790 Overview
CVE-2026-62790 is a heap-based buffer overflow [CWE-122] in the Windows Server Message Block (SMB) Server. An authenticated attacker with low privileges can send crafted SMB traffic over the network to trigger memory corruption and execute arbitrary code on the target host. The flaw affects a broad range of Microsoft desktop and server operating systems, including Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Successful exploitation compromises confidentiality, integrity, and availability of the affected system.
Critical Impact
An authenticated network attacker can achieve remote code execution against the SMB Server service, enabling lateral movement and potential domain-wide compromise in Windows environments.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62790 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62790
Vulnerability Analysis
The vulnerability resides in the Windows SMB Server implementation, which handles file, printer, and named-pipe sharing over the network. A heap-based buffer overflow [CWE-122] occurs when the service processes attacker-controlled input without correctly validating the size of data written into a heap-allocated buffer. Overflowing an adjacent heap chunk allows an attacker to corrupt heap metadata or object fields used by the SMB service. Because SMB Server runs in a privileged context, memory corruption can be leveraged to redirect execution flow and run attacker-supplied code.
Root Cause
The defect stems from improper bounds checking within an SMB request-handling code path. Attacker-supplied length or offset fields in an SMB message are used to write data into a fixed-size heap buffer without enforcing the allocation size, producing an out-of-bounds write on the heap.
Attack Vector
Exploitation requires network access to the SMB service (typically TCP port 445) and valid low-privilege credentials on the target. No user interaction is required. After authentication, the attacker sends a specially crafted SMB request sequence that triggers the overflow. This vector is particularly relevant on internal networks where SMB is broadly reachable and where a single compromised low-privilege account can be reused across many hosts.
No public proof-of-concept code has been referenced for this CVE. See the Microsoft CVE-2026-62790 Advisory for vendor technical details.
Detection Methods for CVE-2026-62790
Indicators of Compromise
- Unexpected crashes, restarts, or exception events for the LanmanServer service or srv2.sys / srvnet.sys drivers.
- Anomalous SMB sessions from low-privilege accounts followed by process creation under System or NT AUTHORITY\SYSTEM.
- New services, scheduled tasks, or persistence artifacts appearing shortly after inbound SMB activity on TCP/445.
Detection Strategies
- Hunt for authenticated SMB sessions immediately preceding suspicious child processes spawned by System or SMB-related processes.
- Correlate Windows Event ID 7031/7034 (service crash) for the Server service with concurrent SMB traffic from a single source.
- Alert on abnormal SMB command sequences or malformed request patterns identified by network intrusion detection signatures targeting CVE-2026-62790.
Monitoring Recommendations
- Ingest Windows Security, System, and SMBServer operational logs into a centralized SIEM for correlation across hosts.
- Monitor east-west SMB traffic between workstations, which is unusual in most enterprise environments and often indicative of lateral movement.
- Track authentication events for low-privilege accounts accessing multiple SMB shares in short time windows.
How to Mitigate CVE-2026-62790
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-62790 Advisory to all affected Windows 10, Windows 11, and Windows Server systems.
- Inventory hosts exposing SMB (TCP/445) and prioritize patching of domain controllers, file servers, and internet-adjacent systems.
- Rotate credentials for any low-privilege accounts that could be abused to authenticate to SMB across the estate.
Patch Information
Microsoft has released security updates for all supported affected Windows and Windows Server versions. Refer to the Microsoft CVE-2026-62790 Advisory for the specific KB articles and update packages that apply to each product and build.
Workarounds
- Block inbound TCP/445 and TCP/139 at the network perimeter and restrict SMB between internal network segments using host-based firewalls.
- Enforce SMB signing and disable SMBv1 across the environment to reduce the attack surface exposed to authenticated clients.
- Apply least-privilege principles so that standard user accounts cannot authenticate to sensitive servers over SMB.
# Restrict inbound SMB to trusted management subnets on Windows hosts
New-NetFirewallRule -DisplayName "Block Inbound SMB (CVE-2026-62790)" \
-Direction Inbound -Protocol TCP -LocalPort 445 \
-Action Block -Profile Any
# Require SMB signing on the server side
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
# Disable legacy SMBv1
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
