Windows SMB Client CVE-2026-62782

Exploitation requires the attacker to operate a network-reachable SMB server and to cause the target Windows host's SMB client to initiate a connection to that server. The CVSS PR:N rating confirms no attacker-side credentials are required; however, the attacker must be positioned to receive inbound TCP 445 connections from the victim, either on the local network or via internet exposure if the target has outbound SMB unblocked. SSVC rates this Automatable:no, indicating reliable mass exploitation without per-target customization is not straightforward - the attacker must induce each victim to connect rather than directly scanning and exploiting passive listeners. The impact is strictly limited to confidentiality (I:N, A:N): no code execution or denial of service results from this flaw alone, and scope is unchanged (S:U), containing impact to the SMB client process context on the vulnerable host.

The CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) positions this as high-severity with a fully unauthenticated network attack path, but multiple contextual signals argue for calibrated urgency rather than emergency response. The EPSS score of 0.89% at the 56th percentile reflects a below-median probability of near-term exploitation, and CISA's SSVC decision framework rates Exploitation:none and Automatable:no - directly contradicting the implication of easy, internet-scale mass exploitation that the raw CVSS vector might suggest. The SSVC Technical Impact of 'partial' also contrasts with CVSS C:H, indicating analysts assess real-world data leakage as limited in practice. There is no KEV listing and no identified public exploit code, meaning this remains theoretical risk at time of analysis. That said, the sheer breadth of affected products - spanning every actively supported Windows desktop and server SKU - means even a mid-sized municipal IT team in tczew should treat this as a standard patch-cycle priority rather than a low-urgency deferral, given the massive population of reachable client systems. The absence of active exploitation provides a reasonable window for coordinated patch deployment via WSUS or endpoint management tooling.

An attacker establishes a malicious SMB server on a network segment reachable by the target Windows system, then triggers an SMB client connection from the victim host - for example, via a UNC path embedded in a phishing document, a web page using a file:// reference, or an automated network enumeration tool on the victim machine. When the Windows SMB client parses the attacker's crafted server response, the out-of-bounds read is triggered and adjacent memory contents may be returned within SMB protocol fields, potentially exposing credentials, tokens, or other in-memory data to the server operator. No public exploit code has been identified at time of analysis.