CVE-2026-62774

Think of the Windows graphics part like a busy warehouse that manages in-memory “items.” This bug lets a local user grab something the system already released, tricking Windows into using that freed space again in a way the attacker can control. The end result is that the attacker can raise their permissions and take admin-level control of the machine.

This matters if you run Windows 10, Windows 11, or Windows Server (2016/2019/2022/2025) on systems where someone with low-level access could get local access to the machine (for example, standard user access). The vulnerability is reachable in a default configuration, but it still requires the attacker to have local access and the ability to execute code on the target machine. It is not primarily a “remote over the internet” risk unless an attacker can already get a foothold on the device.

This should be treated as urgent because it enables local elevation from standard user to higher privileges on affected Windows systems. While the provided information does not show public exploit code or confirmed in-the-wild exploitation specifically for this CVE, the traffic-light verdict is RED and the issue targets a core OS component that can lead to full device takeover once an attacker reaches the machine.

1. Inventory exposure

   • For each managed device, record the OS name (Windows 10/11 or Windows Server version) and the exact build number.
   • Use winver (Win+R → winver) or systeminfo to capture the build.

2. Confirm whether the device is vulnerable

   • Compare the device build against Microsoft’s fixed build numbers below.
   • If your device is on an affected Windows release but not yet at the fixed build, treat it as vulnerable until updated.

3. Patch to the fixed version (by product line)

   • Windows 10: update to one of:
     • 10.0.14393.9418
     • 10.0.17763.9115
     • 10.0.19044.7663
     • 10.0.19045.7663
   • Windows 11: update to one of:
     • 10.0.22631.7517
     • 10.0.26100.9106
     • 10.0.26200.9106
     • 10.0.28000.2704
   • Windows Server 2016: update to 10.0.14393.9418
   • Windows Server 2019: update to 10.0.17763.9115
   • Windows Server 2022: update to 10.0.20348.5440
   • Windows Server 2025: update to 10.0.26100.33222

4. Rollout guidance (practical)

   • Prioritize machines at higher risk of local access by untrusted parties (shared PCs, customer-facing terminals, technician-access systems, or workstations where standard-user accounts are common).
   • Test on a small group first if you have a strict change-control process.

5. If patching is delayed

   • Reduce local access exposure: ensure only trusted staff can log on locally, and limit the number of standard user accounts that have the ability to run arbitrary code.
   • Strengthen workstation access controls (separate admin and standard users, lock screens, and tighten physical access) to reduce the chance an attacker can satisfy the local-code-execution precondition.

6. Monitor after patch

   • Verify devices report as updated to the target fixed build.
   • Watch for unusual local privilege changes or account permission modifications on endpoints that were exposed to untrusted local users.

7. KEV/CISA timing

   • This CVE is not listed in the CISA KEV catalog in the provided findings, so no specific KEV due date is applicable from this dataset.

CVE-2026-62774 is a Windows Graphics Kernel local privilege escalation vulnerability mapped to CWE-416 (use-after-free). The mechanism is described as the graphics kernel managing memory in a way that allows a local attacker to reuse freed resources, enabling them to elevate privileges from low-privilege to administrator level on the same machine.

Exploitation status from provided sources: there is no clear dated press claim of exploitation for this specific CVE, and no public exploit code is recorded. EPSS is provided as a low predicted likelihood with a flat trend, but no public exploitation confirmation is mentioned that would override that.

KEV status: not listed in CISA KEV in the provided findings. Actor note: the findings mention “Lazarus group” in PULSE context, but no direct linkage to exploitation of this specific CVE is provided in the dataset.

Attack vector and reachability: local attacker with low privileges; no user interaction required; reachable in default configuration per the provided findings. Preconditions explicitly require local access and the ability to execute arbitrary code on the target machine.