Windows Kernel CVE-2026-62708

Exploitation requires physical presence at the target device (AV:P) - the attacker must be able to interact with the machine directly, whether via the keyboard, a connected peripheral, or a DMA-capable hardware interface. The high attack complexity (AC:H) indicates that exploitation is not straightforward: specific conditions such as precise timing, a particular kernel state, or a specific hardware event must be achieved, reducing reliability and eliminating automation viability (confirmed by SSVC Automatable: no). No credentials are required (PR:N per CVSS), meaning the attacker does not need an OS account - only physical access. Limiting factors: remote exploitation is categorically excluded by the physical attack vector; high complexity reduces opportunistic success rates; no current public exploit or active exploitation reported; attack is not automatable and cannot be scaled across multiple targets simultaneously.

The CVSS 6.4 score with vector AV:P/AC:H/PR:N/UI:N reflects a meaningful practical constraint: physical presence at the device is mandatory, and the high attack complexity (AC:H) indicates precise timing or specific hardware conditions must be met, reducing opportunistic exploitation likelihood. The SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: total) confirms no active exploitation at time of reporting while acknowledging the theoretical severity - full kernel compromise. EPSS data was not provided in the source intelligence, so quantitative exploitation probability cannot be cited. No CISA KEV listing and no public proof-of-concept further reduce urgency for remote or network-perimeter-focused teams. Physical access controls are the primary compensating boundary: organizations that enforce strict data center and endpoint physical security already mitigate the primary attack vector, while those with open physical access policies - such as shared workspaces, retail deployments, or unmanaged endpoint fleets - face meaningfully higher residual risk.

An attacker with unescorted physical access to a vulnerable Windows 11 or Server 2025 device connects a specially crafted hardware peripheral or triggers a kernel code path via the local console, inducing a use-after-free condition in the kernel's memory management. By carefully timing the interaction to satisfy the high-complexity condition - potentially exploiting a race between memory deallocation and a subsequent kernel reference - the attacker redirects kernel execution to attacker-controlled data and achieves SYSTEM-level privilege escalation. No public proof-of-concept has been identified at time of analysis, making this scenario currently theoretical for most threat models.