Heap Buffer Overflow in Windows Win32K Enables Local Privilege Escalation
CVE-2026-62712 is a heap-based buffer overflow (CWE-122) in the Windows Win32K kernel component, with Microsoft's related advisories (ZDI-26-542/618/619/620/621) tying the flaw to user-mode printer driver (UMPD) graphics callbacks such as UMPDDrvBitBlt, UMPDDrvStretchBlt and UMPDDrvRealizeBrush. A local attacker with valid low-privileged credentials can trigger the overflow through crafted GDI/printer-driver operations, with no user interaction required. Successful exploitation elevates the attacker from a standard user to kernel/SYSTEM level, yielding high confidentiality, integrity and availability impact on the host. Every Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server (2012, 2016, 2019, 2022) installation on the listed builds is affected, which spans most of the supported Windows fleet. There is no public proof-of-concept, no CISA KEV listing, and a low EPSS of 0.4%, indicating no confirmed exploitation to date.
What to do: Apply the patch for CVE-2026-62712 from Microsoft's security update on all listed Windows 10, Windows 11 and Windows Server builds, prioritizing multi-user systems such as RDS hosts and print servers where untrusted users can execute code. Until patched, restrict interactive logon rights on servers to trusted users, since a kernel win32k overflow of this type has no reliable workaround. Verify remediation against the build numbers listed in Microsoft's advisory rather than assuming a single KB applies to every branch.
| Product | Affected |
|---|---|
| Microsoft Windows 10 | 1607, 1809, 21H2, 22H2 |
| Microsoft Windows 11 | 23H2, 24H2, 25H2, 26H1 |
| Microsoft Windows Server | 2012, 2016, 2019, 2022 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.
ZDI disclosed CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvStretchBlt improper object-management flaw enabling local privilege escalation.
ZDI disclosed CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvPlgBlt improper object-management flaw enabling local privilege escalation.
ZDI discloses CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvBitBlt improper object management flaw allowing local attackers to escalate privileges.
ZDI disclosed CVE-2026-62712, a CVSS 7.8 improper object management flaw in Windows UMPDDrvRealizeBrush enabling local privilege escalation after low-privileged code execution.
ZDI disclosed CVE-2026-62712, a CVSS 7.8 improper object management flaw in Windows UMPDDrvStretchBltROP enabling local privilege escalation from low-privileged code.
Today 369 readers · 400 views · 302 reads · all time 158K views