EUVD-2026-56772
GHSA-gc63-qg7f-c48w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access and a low-privilege account are prerequisites; the flaw is read-only with no integrity or availability impact, and no scope change is possible.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Windows Management Instrumentation (WMI) enables a locally authenticated, low-privileged attacker to disclose potentially sensitive information from process memory. Affecting a broad sweep of Windows client and server releases from Windows Server 2012 through Windows 11 26H1, the flaw is rooted in a memory safety defect in the WMI subsystem (CWE-125). No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected product lines.
Technical ContextAI
Windows Management Instrumentation is a core Microsoft infrastructure component built on the Distributed Management Task Force Common Information Model (CIM) standard, providing a unified interface for management queries, event subscriptions, and operational data across Windows systems. The root cause is CWE-125 (Out-of-bounds Read): the WMI provider host process reads beyond the allocated bounds of an internal buffer, potentially exposing adjacent memory contents to the calling process. The 'Buffer Overflow' tag included in the intelligence alongside CWE-125 may indicate a closely related write-path vulnerability in the same code, though the confirmed impact is read-based information disclosure. EUVD-2026-56772 CPE-equivalent version ranges confirm the flaw spans a wide range of Windows NT kernel builds from 6.2.x (Server 2012) through 10.0.28000.x (Windows 11 26H1), suggesting the defect resides in a long-standing WMI code path rather than a version-specific regression.
RemediationAI
The primary remediation is to apply Microsoft's security updates, which resolve the out-of-bounds read across all affected Windows releases. Based on EUVD-2026-56772 version ranges, the minimum patched builds are: Windows 10 1607 and Server 2016 at 10.0.14393.9418 or later; Windows 10 1809 and Server 2019 at 10.0.17763.9115 or later; Windows 10 21H2 at 10.0.19044.7663 or later; Windows 10 22H2 at 10.0.19045.7663 or later; Windows 11 23H2 at 10.0.22631.7517 or later; Windows 11 24H2 at 10.0.26100.9168 or later; Windows 11 25H2 at 10.0.26200.9168 or later; Windows 11 26H1 at 10.0.28000.2704 or later; Windows Server 2012 at 6.2.9200.26279 or later; Windows Server 2012 R2 at 6.3.9600.23337 or later; Windows Server 2022 at 10.0.20348.5499 or later; Windows Server 2025 at 10.0.26100.33296 or later. Updates are available via Windows Update or the Microsoft Update Catalog. For systems where patching must be temporarily deferred, restricting per-user WMI namespace permissions via the WMI Control snap-in (wmimgmt.msc) can reduce the exploitable surface, though this trade-off may disrupt legitimate monitoring agents and management tooling that rely on broad WMI access. The full Microsoft advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62738.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today