CVE-2026-62798 Overview
CVE-2026-62798 is an untrusted pointer dereference vulnerability [CWE-822] in the Windows Win32K subsystem. An authorized local attacker can exploit the flaw to disclose sensitive information from the affected system. The vulnerability affects multiple current Windows 11 releases and Windows Server 2025. Microsoft published the advisory on 2026-08-11.
Critical Impact
A local authenticated user can trigger a Win32K pointer dereference to read kernel or process memory, exposing sensitive information that can support follow-on privilege escalation.
Affected Products
- Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1 (x64 and ARM64)
- Microsoft Windows Server 2025
- Systems running the vulnerable Win32K kernel-mode driver (win32k.sys / win32kfull.sys)
Discovery Timeline
- 2026-08-11 - CVE-2026-62798 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62798
Vulnerability Analysis
The flaw resides in the Windows Win32K component, a kernel-mode subsystem that services window management and graphics device interface (GDI) calls. Win32K dereferences a pointer whose value is influenced by untrusted input without validating that it references a legitimate kernel object. When the dereference occurs, the kernel reads memory at an attacker-influenced address and returns data to a user-mode caller.
Because the vulnerability discloses memory contents rather than corrupting them, exploitation typically yields kernel address layout information, object handles, or fragments of adjacent allocations. Attackers commonly chain such primitives with a separate memory-corruption bug to defeat Kernel Address Space Layout Randomization (KASLR) and achieve local privilege escalation.
Root Cause
The root cause is classified as [CWE-822: Untrusted Pointer Dereference]. A Win32K syscall or callback path accepts a pointer or index derived from user-controlled state and uses it to reference a kernel structure without verifying its origin, type, or bounds. The dereferenced address is then read and its contents propagated back to the caller.
Attack Vector
Exploitation requires local access and low-privileged authenticated execution on the target host. No user interaction is required, and the attack complexity is low. A malicious process invokes the vulnerable Win32K interface with crafted parameters that steer the internal pointer dereference toward attacker-selected memory. The kernel returns the contents of that memory to the calling process, disclosing information within the kernel security boundary.
No public proof-of-concept is currently available. See the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2026-62798
Indicators of Compromise
- Unexpected user-mode processes issuing high volumes of Win32K syscalls or GDI object queries from non-graphical contexts.
- Newly executed unsigned or low-reputation binaries followed by attempts to enumerate kernel driver base addresses.
- Crash dumps or Event ID 41/1001 entries referencing win32kfull.sys or win32kbase.sys fault addresses.
Detection Strategies
- Hunt for local processes that combine Win32K interaction with token or process handle manipulation, a common precursor to information-disclosure chains.
- Correlate Sysmon Event ID 1 (process create) with subsequent driver-loading or NtQuerySystemInformation calls typical of KASLR-bypass tooling.
- Baseline normal Win32K usage per role and alert on deviations from workstations that do not run interactive GUI workloads, such as build agents or servers.
Monitoring Recommendations
- Enable kernel-mode auditing and forward Windows Defender Exploit Guard and PatchGuard events to a centralized SIEM.
- Monitor for local privilege escalation attempts following any information-disclosure telemetry, since Win32K leaks are typically stepping stones.
- Track patch compliance for Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025 endpoints on a per-host basis.
How to Mitigate CVE-2026-62798
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-62798 to all affected Windows 11 and Windows Server 2025 systems.
- Restrict local logon rights on servers and shared workstations to reduce the pool of accounts that satisfy the local, authenticated prerequisite.
- Inventory endpoints against the affected CPE list and prioritize patching for multi-user hosts, jump servers, and terminal services.
Patch Information
Microsoft has released fixes as part of its security update cycle. Consult the Microsoft Security Update CVE-2026-62798 advisory for the specific KB article and build numbers applicable to each Windows 11 servicing branch and Windows Server 2025.
Workarounds
- No official workaround has been published by Microsoft; applying the security update is the supported remediation.
- Enforce application allowlisting through Windows Defender Application Control (WDAC) or AppLocker to block untrusted local binaries from invoking the vulnerable Win32K paths.
- Apply the Microsoft-recommended attack surface reduction rule to block Win32K calls from Office child processes and restrict scripting engines from spawning binaries that call kernel graphics APIs.
# Verify installed KB and Win32K driver version on Windows
wmic qfe list brief /format:table
Get-Item C:\Windows\System32\win32kfull.sys | Select-Object VersionInfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
