Windows Management Instrumentation CVE-2026-62738

Exploitation requires an authorized local user account with low privileges on the target system - the CVSS PR:L metric confirms a standard (non-administrative) authenticated session is sufficient, and AV:L confirms local system access is mandatory with no network-based exploitation path. The attacker must be able to execute WMI queries or invoke WMI provider methods, which is a capability available to all standard Windows user accounts by default. Limiting factors include: the requirement for a pre-existing, authenticated local session (no anonymous or network-remote exploitation); the scope-unchanged metric (S:U) confirming the flaw cannot be leveraged to pivot to other systems or escalate to kernel; and the absence of any integrity or availability impact. Hardened environments that restrict WMI namespace permissions for non-administrative users may further reduce exploitability beyond the baseline low-privilege requirement.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N yields a base score of 5.5 (Medium), accurately reflecting that exploitation is gated behind local access and a valid low-privilege account, which substantially narrows the realistic attack surface compared to network-exploitable flaws. The SSVC decision framework fully corroborates this posture: exploitation status is confirmed 'none,' the vulnerability is not automatable (requiring interactive local presence), and technical impact is assessed as only 'partial.' No CISA KEV listing exists and no public proof-of-concept code has been identified, meaning a mid-sized IT team in walbrzych managing a heterogeneous Windows estate should treat this as a routine patch-cycle priority rather than an emergency out-of-band response. The high Confidentiality metric (C:H) is the primary driver of concern - WMI processes interact with sensitive system data and could expose credentials or configuration material from adjacent memory - but the absence of integrity or availability impact and the mandatory local-access prerequisite keep real-world risk firmly in the moderate tier. EPSS data was not present in the provided intelligence, and no conflicting signals between the CVSS vector and description were identified.

A local attacker holding a standard Windows user account on an unpatched system crafts a WMI query or invokes a WMI provider method specifically designed to trigger the out-of-bounds read in the WMI host process. The resulting memory disclosure could expose sensitive adjacent memory contents - such as in-flight credentials, cryptographic material, or privileged process data - to the low-privilege caller. No public exploit has been identified at time of analysis, and the mandatory local access requirement limits opportunistic or mass exploitation.