ZDI-26-620: Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability
ZDI disclosed CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvPlgBlt improper object-management flaw enabling local privilege escalation.
Zero Day Initiative advisory ZDI-26-620 describes an improper object management flaw in Microsoft Windows' UMPDDrvPlgBlt component, sharing CVE-2026-62712 with the related UMPDDrvStretchBlt advisory. A local attacker able to run low-privileged code can escalate privileges on affected installations. The issue carries a CVSS 3.0 rating of 7.8.
- Local privilege escalation in Windows UMPDDrvPlgBlt component
- Shares CVE-2026-62712 with the related UMPDDrvStretchBlt advisory
- CVSS 3.0 score of 7.8 assigned by ZDI
- Exploitation requires prior execution of low-privileged code
- CVEs
- CVE-2026-62712
- Vendors
- MicrosoftZero Day Initiative
- Products
- Windows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-62712 | Heap Buffer Overflow in Windows Win32K Enables Local Privilege Escalation | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.