Windows Network Connection Broker CVE-2026-72967

Exploitation requires a local authenticated session on the target system with at least low-privileged user rights (PR:L). The attacker must be able to interact with the Windows Network Connection Broker service, which runs by default on Windows systems supporting UWP/Store app network brokering - no special non-default configuration is required to expose the vulnerable component. There is no network-facing attack surface for this vulnerability; the AV:L vector confirms the attacker must have local access. No user interaction from a second user is required (UI:N). Exploitation is limited by the requirement for local authenticated access - remote unauthenticated attackers cannot exploit this directly and would first need to establish a foothold (e.g., via a separate RCE vulnerability or valid credentials for RDP/SSH).

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with a classic local privilege escalation primitive: any authenticated local user can exploit this deterministically with no interaction from other users. The AC:L rating indicates reliable, repeatable exploitation - heap overflows in Windows system services have historically been weaponized into stable LPE exploits once heap layout is understood. The S:U (unchanged scope) limits the blast radius to the local machine and does not allow network propagation on its own, but in real-world attack chains, LPE is typically chained after initial access (phishing, RCE, etc.) to achieve full host compromise. No public exploit code has been identified and the vulnerability is not in CISA KEV, suggesting it has not yet been observed in active exploitation. The extremely broad affected version range (19 distinct Windows builds listed, including legacy Server 2012 and Server 2012 R2) is a significant amplifier: environments running end-of-life Windows Server 2012/2012 R2 may face extended exposure if ESU patches are not applied. EPSS data was not provided in the input; risk priority should be driven by the broad platform footprint and the AC:L exploitability.

An attacker who has obtained a low-privileged local user account on a Windows workstation or server - for example, via phishing leading to a standard user shell - sends a crafted input to the Network Connection Broker service that triggers a heap overflow, corrupting heap metadata to redirect execution. The attacker leverages this to execute arbitrary code as SYSTEM, gaining full control of the host. No public proof-of-concept has been identified at time of analysis, so exploitation currently requires independent vulnerability research, but the AC:L rating indicates the overflow is reliably triggerable.