Windows SMB Client CVE-2026-62799

Exploitation requires an authorized local user account with at least low privilege (PR:L per CVSS) on a Windows 11 version 26H1 system at build 10.0.28000.0 through 10.0.28000.2703. The attacker must be able to execute code locally - either via physical access, RDP/terminal services session, or as a result of prior compromise. The CVSS attack vector is local (AV:L), explicitly ruling out remote unauthenticated exploitation. No special non-default SMB client configuration is identified in the available data as a prerequisite; the vulnerability appears to reside in the standard SMB client stack activated during normal SMB operations. Key limiting factors: requires local logon capability (eliminates purely external attackers without existing foothold); no user interaction required from a victim (attacker acts independently); scope is unchanged (S:U), meaning exploitation does not pivot to other systems directly from this flaw alone.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) characterizes this as a high-severity local privilege escalation: low attack complexity and no user interaction needed mean that once an attacker has local code execution, escalation to SYSTEM is technically straightforward. No EPSS score was provided in the input, so probabilistic exploitation forecasting cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, which meaningfully reduces immediate urgency relative to remotely exploitable or KEV-listed flaws. In practice, this vulnerability is most relevant as a post-exploitation step - an attacker who already has foothold on a Windows 11 26H1 host could use it to gain full SYSTEM privilege. On multi-user or shared systems (e.g., RDP servers, developer workstations), the risk is elevated. The low attack complexity (AC:L) is the most concerning signal: it suggests no race conditions, special timing, or unusual environment is required to trigger the overflow reliably.

An attacker with a low-privileged domain or local account on a Windows 11 26H1 workstation crafts a sequence of SMB client operations designed to trigger the heap-based buffer overflow in the SMB client stack, overwriting heap control structures or a function pointer with attacker-controlled values. Upon controlling execution flow, the attacker redirects to shellcode or a ROP chain that spawns a SYSTEM-level process, achieving full host compromise. No public proof-of-concept has been identified, but the low attack complexity (AC:L) indicates no unusual environmental prerequisites, suggesting a reliable exploit is feasible for a skilled attacker.