Windows Schannel CVE-2026-62779

Exploitation requires an active low-privileged local user session on the target machine - the CVSS PR:L metric confirms a standard (non-administrator) account is sufficient. No non-default Windows configuration is required: Schannel is enabled and active in all affected Windows 11 and Windows Server 2025 installations by default, as it is the OS-level TLS provider. No user interaction is required (UI:N). The attack is strictly local (AV:L); an attacker cannot exploit this remotely without first obtaining a local code execution foothold via a separate vulnerability or access method. The primary limiting factors are: (1) local access is required - purely remote, unauthenticated exploitation is not possible; (2) affected OS versions are bounded to Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 - older platforms are not listed as affected.

The CVSS 7.8 base score is well-supported by the vector: AV:L rules out remote unauthenticated exploitation but does not diminish the severity for post-compromise scenarios, where local privilege escalation is a critical step in ransomware deployment and lateral movement. AC:L indicates no race condition or timing dependency is required, meaning a working exploit would be deterministic and reliable. The full C:H/I:H/A:H impact triad aligns with SYSTEM-level code execution. No EPSS score is available in the provided data, which prevents probabilistic exploitation forecasting. The absence of a KEV listing and no reported POC lower immediate urgency relative to the raw score, but LPE flaws in core Windows cryptographic subsystems are historically high-value targets for threat actors with existing footholds. Tags include 'Denial Of Service' alongside privilege escalation, suggesting the memory corruption may also be triggerable as a crash without full control, expanding the potential impact surface. Overall, this is a genuine priority for environments with untrusted local users (VDI, shared servers, contractor access) and a secondary priority for well-controlled single-user workstations.

An attacker who has obtained a low-privileged local account - through phishing, credential stuffing, or as an insider - calls into the Windows Schannel API (e.g., initiating a TLS handshake) in a manner that triggers the use-after-free condition, freeing a Schannel session object while a reference is retained. By reclaiming the freed heap region with attacker-controlled data, the attacker corrupts a function pointer or security descriptor and redirects execution to shellcode or a ROP chain, achieving SYSTEM-level code execution. The low attack complexity (AC:L) suggests no special timing or heap-grooming finesse is required once the triggering condition is known.