CVE-2026-72967

CVE-2026-72967 is a heap-based buffer overflow (CWE-122) in the Windows Network Connection Broker, a built-in Windows service that manages network connectivity requests for applications. To trigger it, an authorized attacker must already be able to execute code on the local machine with low privileges, and no user interaction is required. Successful exploitation lets the attacker elevate their privileges locally, gaining high confidentiality, integrity, and availability impact on the target system. Any Windows installation where users can run untrusted code is affected, since the vulnerable component is a core Windows service; the data does not specify which Windows versions or builds are impacted. As of this analysis there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and its low EPSS score (0.3%, 25th percentile) suggests exploitation activity is limited or nonexistent.

What to do: Check Microsoft's advisory and Windows Update for the designated security patch and apply it on an accelerated schedule, prioritizing multi-user systems, remote desktop hosts, and shared workstations where local accounts are common. Because exploitation requires an attacker to already run low-privileged code locally, limiting local logon rights and monitoring for suspicious process token changes can reduce interim risk. Verify affected builds in Microsoft's advisory, since the version ranges were not provided in this dataset.