Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

ZDI details four Windows UMPD improper object management flaws (ZDI-26-618, ZDI-26-619, ZDI-26-620, ZDI-26-621) sharing CVE-2026-62712, each rated CVSS 7.8 for local privilege…

1 source · 4 articlesFirst reported Updated ()2
What's new

No new advisories, figures, or exploitation-status updates since the previous summary written 2026-09-09T04:42:15.659Z: all four reports remain the 2026-09-08 (05:00 UTC) ZDI publications already covered. This update consolidates the story around the four Windows UMPD advisories sharing CVE-2026-62712 (ZDI-26-618, ZDI-26-619, ZDI-26-620, ZDI-26-621); the Windows MIDI Service advisory covered in…

Merged summary · glm-5.3-flash · rewritten as coverage arrivesSummaries by Vani AI

The Zero Day Initiative published four Microsoft Windows advisories on 2026-09-08 describing improper object management flaws in the UMPDDrvStretchBlt (ZDI-26-618), UMPDDrvStretchBltROP (ZDI-26-619), UMPDDrvPlgBlt (ZDI-26-620) and UMPDDrvRealizeBrush…

The Zero Day Initiative published four Microsoft Windows advisories on 2026-09-08 (all timestamped 05:00 UTC), each covering an improper object management flaw in a Windows UMPD component and each tracked under the same CVE identifier, CVE-2026-62712: ZDI-26-618 (UMPDDrvStretchBlt), ZDI-26-619 (UMPDDrvStretchBltROP), ZDI-26-620 (UMPDDrvPlgBlt) and ZDI-26-621 (UMPDDrvRealizeBrush). In every case, a local attacker who can already execute low-privileged code on the target system can escalate privileges on affected Windows installations. ZDI assigned a CVSS score of 7.8 to the flaw; the CVSS 3.0 version is explicit in the ZDI-26-618 and ZDI-26-620 advisories, while the ZDI-26-619 and ZDI-26-621 advisories cite the 7.8 score without naming the version. The identifier sharing is stated in the reports themselves: the ZDI-26-620 advisory notes it shares CVE-2026-62712 with the related UMPDDrvStretchBlt advisory, and the ZDI-26-619 advisory notes it shares the identifier listed in the companion UMPDDrvRealizeBrush advisory. The ZDI-26-618 advisory states that details on affected versions and patch availability are limited, and none of the four reports states an exploitation status. No exploit code was included in any of the reports.

Key facts
  • CVE-2026-62712 is the single CVE identifier listed by all four advisories: ZDI-26-618, ZDI-26-619, ZDI-26-620 and ZDI-26-621.
  • ZDI-26-618: improper object management in Windows UMPDDrvStretchBlt, rated CVSS 3.0 7.8, enabling local privilege escalation.
  • ZDI-26-619: improper object management in Windows UMPDDrvStretchBltROP, rated CVSS 7.8, enabling local privilege escalation.
  • ZDI-26-620: improper object management in Windows UMPDDrvPlgBlt, rated CVSS 3.0 7.8, enabling local privilege escalation.
  • ZDI-26-621: improper object management in Windows UMPDDrvRealizeBrush, rated CVSS 7.8, enabling local privilege escalation.
  • All four advisories were published 2026-09-08, timestamped 05:00 UTC.
  • Exploitation of each flaw requires prior execution of low-privileged code on the target system; impact is local privilege escalation on affected Windows installations.
  • Sharing of CVE-2026-62712 is explicit in the reports: ZDI-26-620 references the UMPDDrvStretchBlt advisory and ZDI-26-619 references the companion UMPDDrvRealizeBrush advisory.
Analyze CVE-2026-62712 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-62712
Vendors
MicrosoftZero Day Initiative
Products
Windows
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · Sep 8, 2026 ZDI Published AdvisoriesFirst report

    ZDI-26-621: Microsoft Windows UMPDDrvRealizeBrush Improper Object Management Local Privilege Escalation Vulnerability

    ZDI disclosed CVE-2026-62712, a CVSS 7.8 improper object management flaw in Windows UMPDDrvRealizeBrush enabling local privilege escalation after low-privileged code execution.

  2. · Sep 8, 2026 ZDI Published Advisories

    ZDI-26-618: Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability

    ZDI disclosed CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvStretchBlt improper object-management flaw enabling local privilege escalation.

  3. · Sep 8, 2026 ZDI Published Advisories

    ZDI-26-620: Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability

    ZDI disclosed CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvPlgBlt improper object-management flaw enabling local privilege escalation.

  4. · Sep 8, 2026 ZDI Published Advisories

    ZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

    ZDI disclosed CVE-2026-62712, a CVSS 7.8 improper object management flaw in Windows UMPDDrvStretchBltROP enabling local privilege escalation from low-privileged code.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-62712
Heap Buffer Overflow in Windows Win32K Enables Local Privilege Escalation
7.8<1%