Windows Kernel CVE-2026-62737

Exploitation requires a locally authenticated account with at minimum standard user privileges, as confirmed by PR:L in the CVSS vector - the attacker must have interactive or programmatic local access to the target system. No second-user interaction is required (UI:N), and no indication exists that a specific non-default configuration is necessary; the vulnerability appears to affect default kernel behavior across all named versions. Exploitation is strictly constrained to local access (AV:L), meaning remote unauthenticated attack is not possible without a separate preceding initial-access vector. Affected versions are Windows 11 24H2, 25H2, and 26H1, and Windows Server 2025 (all editions including Server Core); systems running fully patched builds are not affected.

The CVSS 3.1 score of 7.8 (High) is consistent with the vulnerability's profile: a reliable local privilege escalation with full C/I/A impact, requiring only a standard local account. The local attack vector (AV:L) is the primary mitigating factor - remote unauthenticated exploitation is not directly possible and requires a preceding initial-access vulnerability. AC:L and PR:L together indicate the exploit primitive is low-complexity and accessible to any unprivileged user, making this highly attractive as a post-exploitation pivot in multi-stage attack chains. No EPSS score or KEV listing is available in the provided data, so exploitation probability and active threat actor targeting cannot be independently quantified. Notably, the supplied tags include 'Information Disclosure', which conflicts with the CVSS vector's C:H/I:H/A:H impact and the description's explicit 'elevate privileges' language - the actual impact appears to be full privilege escalation rather than disclosure alone; defenders should verify this against the MSRC advisory directly. No public POC has been identified at time of analysis.

An attacker who has obtained a standard local user account - via credential theft, phishing, or exploitation of a separate initial-access vulnerability - crafts a user-mode request that passes a controlled pointer value into the vulnerable Windows Kernel code path. The kernel dereferences the untrusted pointer without validation, allowing the attacker to achieve ring-0 code execution and escalate their session to SYSTEM, enabling full control of the host including credential harvesting, lateral movement, or ransomware deployment. No public POC exists at time of analysis, but the low attack complexity indicates the vulnerable code path does not require race conditions or non-trivial heap manipulation.