Windows Kerberos CVE-2026-62752

The attacker must hold a valid low-privilege local account on the target system, as confirmed by the CVSS vector metric PR:L. The attack vector is strictly local (AV:L), so the attacker must already have an interactive session or equivalent local code execution capability, such as via RDP, a local shell, or a previously exploited service running under a low-privilege identity. Because Kerberos is the default authentication protocol on all Active Directory domain-joined Windows systems, no non-default configuration is required - the vulnerable code path is active by default in any domain-joined deployment. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race condition or special timing is necessary. Exploitation is scoped to the local system (S:U); lateral movement to other hosts requires a separate, subsequent step. The primary limiting factor is the requirement for prior local access: attackers without an existing foothold on the target system cannot exploit this remotely. Systems not domain-joined may still be affected if Kerberos is locally configured, but domain-joined enterprise endpoints and servers constitute the primary at-risk population.

The CVSS 7.8 base score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: local access and a low-privilege account are the only prerequisites, while the impact is total compromise of the local system across all three CIA dimensions. The low attack complexity (AC:L) is the most operationally significant metric - no race condition, timing dependency, or unusual configuration is required to trigger the overflow, which substantially lowers the skill bar for potential exploitation. No EPSS data was supplied in the input, so exploitation probability cannot be quantified precisely, but the sheer breadth of affected platform versions means exposure is enormous across enterprise environments - even a mid-sized municipal IT team in leszno should treat this as urgent given that virtually every domain-joined Windows machine in their fleet likely falls within the affected build ranges. The absence of a KEV listing and public exploit code moderates immediate urgency slightly, but the straightforward attack complexity and ubiquity of the affected platform make this a high-priority patching target with no signal conflict between the CVSS vector and the vulnerability description.

An attacker who has obtained a low-privilege local account on a Windows domain member - through phishing, credential reuse, or an earlier initial-access vulnerability - establishes a local session and issues a crafted Kerberos authentication request that triggers the heap-based buffer overflow in the Windows Kerberos component. The heap corruption overwrites adjacent memory structures, redirecting execution and elevating the attacker to SYSTEM privileges without any user interaction. With SYSTEM access the attacker can dump credential hashes from LSASS, disable endpoint security tooling, and pivot laterally across the domain; no public exploit code has been identified at time of analysis, but the low attack complexity indicates the trigger is reliably reproducible without specialized tooling.