Windows Kerberos CVE-2026-62773

Exploitation requires an existing authenticated local session with at least standard (low-privileged) user credentials on the target Windows system, consistent with CVSS PR:L and AV:L. The Kerberos subsystem is enabled by default on domain-joined Windows systems; non-domain workgroup machines relying solely on NTLM may have reduced exposure to this specific code path, though this is not explicitly confirmed by the vendor. High attack complexity (AC:H) means exploitation is not straightforward - the attacker must achieve specific heap memory conditions or win a race condition within the Kerberos implementation before the primitive becomes useful. Remote unauthenticated exploitation is not possible. The combination of local access and AC:H limits realistic attackers to insiders, or threat actors who have already compromised at least one low-privilege account on the target host.

The CVSS 3.1 base score of 7.0 reflects a meaningful but constrained threat profile. The local attack vector (AV:L) eliminates direct remote exploitation - an attacker must already possess a foothold on the target machine. The low-privilege requirement (PR:L) means any standard domain or local user account suffices, which is a significant enabler in enterprise environments. High attack complexity (AC:H) is the primary limiting factor: successful exploitation of a use-after-free typically demands precise heap feng shui or race-condition timing, making reliable exploitation non-trivial. Full C:H/I:H/A:H impact reflects the consequence of successful exploitation - arbitrary code execution as SYSTEM, consistent with the Denial of Service tag suggesting the UAF can also crash the subsystem. No EPSS score was provided in the input data, and no CISA KEV listing or public POC is present, indicating no confirmed or widespread exploitation at time of analysis. In practice, this is a real but second-tier priority: critical in environments where insider threat or post-compromise lateral movement is a concern, but not immediately exploitable from the internet.

An attacker who has obtained a standard low-privilege local user account on a domain-joined Windows workstation or server crafts a sequence of Kerberos authentication operations designed to trigger a use-after-free in the Kerberos subsystem, manipulating the freed memory region to control subsequent execution. Successful exploitation requires navigating high complexity conditions - likely a race condition or specific heap layout - before redirecting control flow to attacker-supplied code running as SYSTEM. No public exploit or POC has been identified at time of analysis.