Windows Push Notifications CVE-2026-62697

Exploitation requires a low-privileged local account on an affected, unpatched Windows system - a standard (non-admin) user session obtained via interactive logon, RDP, or malware running under a standard user token is sufficient (PR:L, AV:L). The Windows Push Notifications subsystem runs by default on all affected editions; no special feature enablement or non-default configuration is required. No user interaction is needed beyond the attacker's own actions (UI:N). The primary limiting factor is local access: remote exploitation is not possible without first achieving local code execution through a separate vulnerability or credential compromise. Exploitation scope is contained within the attacked system (S:U) - no lateral movement is implied by the vulnerability itself.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for a local privilege escalation: the local-only vector (AV:L) substantially limits remote exploitability, but PR:L means any standard user account - including those obtained via phishing, RDP, or malware dropper - is sufficient. The low attack complexity (AC:L) implies reliable exploitation without race conditions or heap grooming prerequisites, which is notable for a UAF class and raises practical risk above average for this CWE. No EPSS data was supplied, no KEV listing exists, and no public PoC has been identified, placing this in the 'high-CVSS but unconfirmed exploitation' category. That said, Windows LPE UAFs in notification subsystems are a historically favored target for advanced threat actors building privilege escalation modules - the breadth of affected releases (nine Windows SKUs) amplifies the potential impact across enterprise fleets. The 'Denial of Service' tag appears to reflect an ancillary crash-mode effect of the UAF, not the primary security impact, which is privilege escalation.

An attacker who has obtained a low-privileged user session on an unpatched Windows host - via phishing, RDP brute force, or malware dropper - invokes a crafted sequence of calls into the Windows Push Notifications subsystem that triggers the use-after-free, then reclaims the freed memory with attacker-controlled content to redirect execution to arbitrary code. Successful exploitation yields a SYSTEM token, enabling kernel driver installation, security tool disablement, or credential harvesting from lsass. No public exploit code has been identified, but the low attack complexity (AC:L) in the CVSS vector suggests reliable triggering once the primitive is understood.