Windows Remote Desktop Services CVE-2026-62692

The attacker must already hold an authenticated local session on the target Windows system with at least low-level privileges - consistent with the description's 'authorized attacker' language and the CVSS PR:L metric. The Windows Remote Desktop Services component must be accessible from that session; RDS is present on all affected Windows editions by default, though the degree of exposure varies by host role and configuration. No external network adjacency or remote access is required (AV:L); exploitation occurs entirely within an existing authenticated local context. Unauthenticated or anonymous remote attackers cannot directly exploit this vulnerability. The primary limiting factor is the requirement for prior authenticated access to the target host, meaning attackers must first establish a foothold via another vector before leveraging this flaw for privilege escalation.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes the risk: an authenticated local user with minimal privileges can reliably escalate to full system compromise under default conditions, with no user interaction required and low attack complexity. EPSS data was not present in the source intelligence, so a quantified exploitation probability cannot be stated - this gap is noted explicitly. No CISA KEV listing exists, and no public proof-of-concept has been identified at time of analysis, suggesting exploitation remains limited or non-public. Despite the absence of confirmed active exploitation, the low attack complexity combined with near-universal Windows deployment means that even a mid-sized municipal IT department in radom should treat this as an urgent patching priority, particularly for Windows Server hosts running RDS roles in multi-user or multi-tenant environments. The unchanged scope (S:U) indicates the escalation is contained to the compromised host rather than propagating to adjacent systems, which is a meaningful containment factor in well-segmented network environments but does not diminish the severity of full host compromise.

An attacker who has acquired a low-privileged local account on a Windows system - through phishing, credential theft, or lateral movement from a prior compromise - authenticates to a session and issues a specially crafted request to the Remote Desktop Services subsystem that triggers the heap-based buffer overflow. By overwriting adjacent heap memory, the attacker corrupts control structures to redirect execution flow, elevating their session to SYSTEM-level privileges on the host. No public proof-of-concept has been identified at time of analysis; however, the low attack complexity (AC:L) indicates that once a reliable exploit is developed it would be consistently reproducible across the wide range of affected build versions.