CVE-2026-62737

CVE-2026-62737 is an untrusted pointer dereference (CWE-822) in the Windows Kernel, meaning the kernel dereferences a pointer influenced by untrusted input without adequate validation. A local, authenticated attacker with low privileges can trigger the flaw by running crafted code on the target machine, with no user interaction required. Successful exploitation results in elevation of privilege, allowing the attacker to move from their low-privileged context to kernel/SYSTEM-level control with high impact on confidentiality, integrity, and availability. Affected platforms are Windows 11 24H2, 25H2, and 26H1, and Windows Server 2025. There is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates roughly a 2.8% chance of exploitation within 30 days; it is not the zero-day reported under active attack in Microsoft's 400+ vulnerability release (CVE-2026-68820).

What to do: Install Microsoft's cumulative security update that fixes CVE-2026-62737 on Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 (the specific KB/build is not provided in the source data; confirm remediation via update history or winver). Because exploitation requires local low-privileged code execution, prioritize hosts with interactive logons, RDP exposure, multi-user sessions, and VDI when sequencing the patch. When triaging Microsoft's large current release, patch the actively exploited zero-day (CVE-2026-68820) first, but apply this kernel privilege-escalation fix in the same update cycle.