ZDI details four Windows UMPD improper object management flaws (ZDI-26-618, ZDI-26-619, ZDI-26-620, ZDI-26-621) sharing CVE-2026-62712, each rated CVSS 7.8 for local privilege…
The Zero Day Initiative published four Microsoft Windows advisories on 2026-09-08 describing improper object management flaws in the UMPDDrvStretchBlt (ZDI-26-618), UMPDDrvStretchBltROP (ZDI-26-619), UMPDDrvPlgBlt (ZDI-26-620) and UMPDDrvRealizeBrush…
The Zero Day Initiative published four Microsoft Windows advisories on 2026-09-08 (all timestamped 05:00 UTC), each covering an improper object management flaw in a Windows UMPD component and each tracked under the same CVE identifier, CVE-2026-62712: ZDI-26-618 (UMPDDrvStretchBlt), ZDI-26-619 (UMPDDrvStretchBltROP), ZDI-26-620 (UMPDDrvPlgBlt) and ZDI-26-621 (UMPDDrvRealizeBrush). In every case, a local attacker who can already execute low-privileged code on the target system can escalate privileges on affected Windows installations. ZDI assigned a CVSS score of 7.8 to the flaw; the CVSS 3.0 version is explicit in the ZDI-26-618 and ZDI-26-620 advisories, while the ZDI-26-619 and ZDI-26-621 advisories cite the 7.8 score without naming the version. The identifier sharing is stated in the reports themselves: the ZDI-26-620 advisory notes it shares CVE-2026-62712 with the related UMPDDrvStretchBlt advisory, and the ZDI-26-619 advisory notes it shares the identifier listed in the companion UMPDDrvRealizeBrush advisory. The ZDI-26-618 advisory states that details on affected versions and patch availability are limited, and none of the four reports states an exploitation status. No exploit code was included in any of the reports.
- CVE-2026-62712 is the single CVE identifier listed by all four advisories: ZDI-26-618, ZDI-26-619, ZDI-26-620 and ZDI-26-621.
- ZDI-26-618: improper object management in Windows UMPDDrvStretchBlt, rated CVSS 3.0 7.8, enabling local privilege escalation.
- ZDI-26-619: improper object management in Windows UMPDDrvStretchBltROP, rated CVSS 7.8, enabling local privilege escalation.
- ZDI-26-620: improper object management in Windows UMPDDrvPlgBlt, rated CVSS 3.0 7.8, enabling local privilege escalation.
- ZDI-26-621: improper object management in Windows UMPDDrvRealizeBrush, rated CVSS 7.8, enabling local privilege escalation.
- All four advisories were published 2026-09-08, timestamped 05:00 UTC.
- Exploitation of each flaw requires prior execution of low-privileged code on the target system; impact is local privilege escalation on affected Windows installations.
- Sharing of CVE-2026-62712 is explicit in the reports: ZDI-26-620 references the UMPDDrvStretchBlt advisory and ZDI-26-619 references the companion UMPDDrvRealizeBrush advisory.
Coverage timelineoldest first · each row is one article
- · 7d agoZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability
ZDI Published Advisories· 25
ZDI disclosed CVE-2026-62712, a CVSS 7.8 improper object management flaw in Windows UMPDDrvStretchBltROP enabling local privilege escalation from low-privileged code.
- · 7d agoZDI-26-620: Microsoft Windows UMPDDrvPlgBlt Improper Object Management Local Privilege Escalation Vulnerability
ZDI disclosed CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvPlgBlt improper object-management flaw enabling local privilege escalation.
- · 7d agoZDI-26-618: Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability
ZDI disclosed CVE-2026-62712, a CVSS 7.8 Windows UMPDDrvStretchBlt improper object-management flaw enabling local privilege escalation.
- · 7d agoZDI-26-621: Microsoft Windows UMPDDrvRealizeBrush Improper Object Management Local Privilege Escalation Vulnerability
ZDI disclosed CVE-2026-62712, a CVSS 7.8 improper object management flaw in Windows UMPDDrvRealizeBrush enabling local privilege escalation after low-privileged code execution.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-62712 | Heap Buffer Overflow in Windows Win32K Enables Local Privilege Escalation CVE-2026-62712 is a heap-based buffer overflow (CWE-122) in the Windows Win32K kernel component, with Microsoft's related advisories (ZDI-26-542/618/619/620/621) tying the flaw to user-mode printer driver (UMPD) graphics callbacks such as UMPDDrvBitBlt, UMPDDrvStretchBlt and UMPDDrvRealizeBrush. A local attacker with valid low-privileged credentials can trigger the overflow through crafted GDI/printer-driver operations, with no user interaction required. Successful exploitation elevates the attacker from a standard user to kernel/SYSTEM level, yielding high confidentiality, integrity and availability impact on the host. Every Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1) and Windows Server (2012, 2016, 2019, 2022) installation on the listed builds is affected, which spans most of the supported Windows fleet. There is no public proof-of-concept, no CISA KEV listing, and a low EPSS of 0.4%, indicating no confirmed exploitation to date. Do: Apply the patch for CVE-2026-62712 from Microsoft's security update on all listed Windows 10, Windows 11 and Windows Server builds, prioritizing multi-user systems such as RDS hosts and print servers where untrusted users can execute code. Until patched, restrict interactive logon rights on servers to trusted users, since a kernel win32k overflow of this type has no reliable workaround. Verify remediation against the build numbers listed in Microsoft's advisory rather than assuming a single KB applies to every branch. | 7.8 | <1% |
| mass≈1 billion+ Windows installations (every unpatched install of the listed Windows 10/11/Server builds is affected) |