CVE-2026-62786

Win32k Information Disclosure Vulnerability

No known exploitation. EPSS puts it in the 32nd percentile. A vendor fix is available.

CVSS 3.15.5Medium EPSS percentile32nd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your Windows version and current build/patch level (Settings → System → About, or via your update history).
If you are on Windows 10, update so you are at one of these fixed builds: 10.0.14393.9418, 10.0.17763.9115, 10.0.19044.7663, or 10.0.19045.7663.
If you are on Windows 11, update so you are at one of these fixed builds: 10.0.22631.7517, 10.0.26100.9106, 10.0.26200.9106, or 10.0.28000.2704.
If you are on Windows Server, update so you are at one of these fixed builds: Windows Server 2016/2012/2012 R2 → 10.0.14393.9418, Windows Server 2019 → 10.0.17763.9115, Windows Server 2022 → 10.0.20348.5440, Windows Server 2025 → 10.0.26100.33222.
After updating, verify the machine reports the patched build and confirm your Windows Update shows the August 2026 security fixes applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally.

In plain language

Written by AI from the record

CVE-2026-62786 is a Windows flaw that lets a low-privilege attacker read sensitive memory data on the same machine; if you run supported versions and haven’t installed the August 2026 fixes, you should patch urgently.

CVE-2026-62786 is a local information disclosure in the Windows kernel graphics driver (Win32K) caused by incorrect memory-boundary handling, enabling an authenticated/low-privilege attacker to read confidential data from protected memory.

If you're affected

Sensitive data theft from memory
Account or credential exposure risk
Compromise of confidential business data
Increased ransomware likelihood

What is it

This vulnerability is a “read the wrong memory” bug in a Windows graphics component. If someone already has a foothold on the same computer, they may be able to peek at sensitive information stored in memory—like pieces of data used by Windows and applications—without crashing the system.

Who is affected

This matters if you run Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025 on machines where a low-privilege attacker could run code. The risk is tied to local access: an attacker typically needs to be able to execute something on your machine first, then trigger the bug to read protected memory. This is only a concern when it’s reachable from that local attacker position (i.e., not from anonymous remote access on its own).

How urgent is it

Treat this as urgent (RED) because it’s a kernel-level information disclosure that helps an attacker steal data after gaining some local execution capability. The August 2026 Patch Tuesday activity and threat-actor reporting (Lazarus group) increase the chance that real-world adversaries may target this kind of Windows memory disclosure.

What to do — in detail

Identify affected systems
- For each endpoint and server, record: OS edition (Windows 10/11 or which Windows Server), and the current build number.
- Build number is typically shown in Settings → System → About (Windows clients) or via OS build reporting tools.
Check against the fixed build list
- Windows 10 is fixed when your build is one of:
  - 10.0.14393.9418
  - 10.0.17763.9115
  - 10.0.19044.7663
  - 10.0.19045.7663
- Windows 11 is fixed when your build is one of:
  - 10.0.22631.7517
  - 10.0.26100.9106
  - 10.0.26200.9106
  - 10.0.28000.2704
- Windows Server is fixed when your build is one of:
  - Windows Server 2012/2012 R2/2016: 10.0.14393.9418
  - Windows Server 2019: 10.0.17763.9115
  - Windows Server 2022: 10.0.20348.5440
  - Windows Server 2025: 10.0.26100.33222
Patch (recommended path)
- Apply the Microsoft update that includes CVE-2026-62786 for your specific OS/version.
- Use the Microsoft Update Guide entry for this CVE to ensure the correct patch is installed: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62786
Validate
- Re-check the build number after patching and confirm it matches one of the fixed builds above.
- Confirm Windows Update indicates the security update is installed.
If you cannot patch immediately (temporary containment)
- Reduce the chance of an attacker ever getting local code execution by tightening endpoint access controls: least-privilege for users, and review/limit accounts that can run untrusted software.
- Monitor for unusual local execution patterns (e.g., unexpected binaries launched with low-privilege users) and investigate promptly.
- Prioritize patching on any server/endpoint that is exposed to frequent user activity or where attackers commonly gain initial access.
What to monitor after patching
- Review security alerts related to attempts to execute or tamper with system components.
- Track whether any suspicious sessions occurred around the time of patching (this helps confirm you’re not patching after an active intrusion).

Technical context

CVE-2026-62786 is a CWE-125 (out-of-bounds read) in the Windows kernel graphics driver (Win32K). A local attacker with low privileges who can execute code on the system can exploit incorrect memory boundary handling to read confidential information from protected areas of memory. This is local and does not require user interaction. The affected scope includes Windows 10, Windows 11, and multiple Windows Server versions as listed, and Microsoft released fixed builds via the August 2026 Patch Tuesday update cycle; KEV listing was not found in the provided findings, and no public exploit code was reported. PULSE reporting associates this CVE with threat-actor activity (Lazarus group).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS32nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 32nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact