Windows SMB Server CVE-2026-62800

The attacker must possess at least low-privilege network credentials valid on the target system (PR:L per CVSS), meaning unauthenticated exploitation is not possible. The target must have SMB server functionality enabled and reachable over the network (TCP port 445), which is default on Windows systems within enterprise environments. No user interaction is required (UI:N). Exploitation is limited by the authentication prerequisite - anonymous or unauthenticated access to the SMB service is insufficient. The attack does not require any non-default configuration of SMB; standard enabled SMB with any authenticated session is sufficient.

This vulnerability presents a high real-world risk profile, not merely a high CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals low attack complexity over a network with only low-privilege authentication required, with full confidentiality, integrity, and availability impact. The PR:L requirement is the primary limiting factor - an attacker must hold at least one valid domain or local account, which is achievable via credential stuffing, phishing, or insider access. SMB is frequently exposed internally and sometimes externally, meaning the realistic attack surface is broad in most enterprise environments. No EPSS score was provided in the input data, and the vulnerability is not currently listed in CISA KEV, so widespread active exploitation is not confirmed - however, the attack complexity is low enough that even a mid-sized municipal IT team in malbork should treat this as urgent once an authenticated foothold exists. The combination of a network-accessible, low-complexity heap overflow in a universally deployed Windows service warrants priority patching regardless of KEV status.

An attacker with valid low-privilege domain credentials - obtained through phishing or credential reuse - sends a malformed SMB request to a reachable Windows server or workstation over TCP 445. The heap-based buffer overflow in the SMB server driver corrupts heap memory, redirecting execution flow to attacker-controlled code running at kernel privilege. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) indicates the overflow is reliably triggerable without race conditions or specific environment preconditions.