CVE-2026-62697

CVE-2026-62697 is a use-after-free memory corruption flaw (CWE-416) in the Windows Push Notifications component of Microsoft Windows. An authorized attacker — one who already has low-privileged local access — can trigger the flaw without user interaction, causing the Push Notifications service to use freed memory and execute code at elevated privilege. Successful exploitation yields high impact on confidentiality, integrity, and availability on the local system, effectively letting a local user or malware escalate from an unprivileged account to a privileged one. Because the component is part of the Windows operating system, the flaw is broadly relevant to Windows deployments, with practical risk concentrated on systems where untrusted users or code run locally. Exploitation status is currently quiet: no public proof-of-concept is known, the CVE is not in CISA KEV, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

What to do: Install Microsoft's security update for CVE-2026-62697 through Windows Update as part of your regular patch cycle, prioritizing multi-user and untrusted-user systems such as RDS hosts, VDI, and kiosks. Because there is no known in-the-wild exploitation or public PoC, standard cadence patching is a reasonable priority level. Consult Microsoft's advisory to confirm the exact affected product and version scope, since the source data does not specify version ranges.