Windows Graphics Kernel CVE-2026-62702

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special attacker-side prerequisites: no authentication, no user interaction, and no complex attack conditions are required from the attacker's perspective. However, the SSVC 'Automatable: no' rating implies an unspecified constraint complicates reliable mass exploitation - the exact Windows service, protocol, or RPC interface that exposes the Graphics Kernel to untrusted network input is not publicly documented in available references, which itself is a limiting factor for opportunistic attackers. Exploitation is bounded to unpatched systems running the specific Windows build ranges listed in EUVD-2026-56347; fully patched systems at or above the fixed build numbers are not affected. No non-default configuration is required based on available data, and the scope includes both client and server Windows editions.

The CVSS base score of 8.6 is driven by the network-accessible, unauthenticated, zero-interaction vector combined with Scope:Changed and high availability impact - a combination that reflects genuine concern for any organization running unpatched Windows. However, EPSS sits at only 0.84% (55th percentile), indicating low current exploitation probability relative to the broader vulnerability population. The SSVC framework independently rates exploitation as none and automatable as no at time of analysis, suggesting that despite the network vector, reliable at-scale exploitation may require additional conditions or knowledge not yet public - even a mid-sized municipal IT team in tczew should treat this as an urgent patch priority given Windows ubiquity, but the SSVC 'not automatable' and low EPSS together indicate mass opportunistic exploitation is less likely than a comparably scored RCE with weaponized toolkits. No active exploitation is confirmed: this vulnerability does not appear in the CISA KEV catalog and no POC code has been reported. SSVC technical impact rated as partial further tempers the headline score - the vulnerability causes availability loss but not code execution or data disclosure.

An unauthenticated remote attacker sends specially crafted network packets to a vulnerable Windows system, targeting a Graphics Kernel-accessible network code path. The malformed input causes the kernel to dereference a null pointer, triggering a kernel panic (BSOD) that renders the target system entirely unavailable until rebooted. No public exploit code has been identified at time of analysis, and SSVC rates this as not automatable, suggesting that reliable exploitation may require attacker-specific knowledge of the triggering endpoint or protocol behavior.