Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
In plain language
Written by AI from the record
A Windows bug (CVE-2026-62788) could let someone with local access gain higher privileges, so most small businesses should treat it as a serious fix—especially on Windows 11 and Windows Server 2025—by installing the available updates.
CVE-2026-62788 is a Windows Kernel local privilege escalation issue driven by a use-after-free condition (CWE-416); an authorized attacker can exploit it for elevation on systems like Windows 11 and Windows Server 2025 by triggering the vulnerable kernel code path.
If you're affected
Local admin/privilege escalation
Full system compromise
Potential data theft
Operational disruption via compromise
What is it
This is a flaw in the Windows core “kernel” (the part that enforces permissions and controls the computer). If someone already has local access to your machine, the bug could help them escape those limits and gain higher privileges, like getting administrator-level control.
Who is affected
This matters if you run Windows 11 or Windows Server 2025, especially on devices where an attacker could get some kind of local access (for example, a user account or other legitimate way to reach the machine). The exposure is mainly a risk when an attacker is already on the system (“authorized attacker” in the findings), not from a simple remote drive-by. Patch accordingly because the fixed updates are available for both affected products.
How urgent is it
This is a RED-level issue because it’s a kernel privilege-escalation bug (use-after-free) that can turn local access into higher control. The findings also indicate new press attention tied to patch activity and a named actor (Lazarus group), and while no public exploit code is on record and it’s not in CISA KEV, you should still patch promptly since the vulnerability is fixed and attackers with local access are the scenario to guard against.
What to do — in detail
Confirm whether you’re affected
On each Windows 11 / Windows Server 2025 machine, check the OS build number:
Open Settings → System → About (look for OS build).
Or run in an elevated command prompt: winver.
Compare your build against the fixed builds below.
If your build is older than the fixed build for your release line, you should assume you are affected.
Upgrade/patch targets (install Microsoft updates)
Patch to a fixed version listed by Microsoft for this CVE:
Windows 11: fixed in 10.0.22631.7517
Windows 11: fixed in 10.0.26100.9106
Windows 11: fixed in 10.0.26200.9106
Windows 11: fixed in 10.0.28000.2704
Windows Server 2025: fixed in 10.0.26100.33222
Windows 11: fixed in 10.0.26100.9168
Windows 11: fixed in 10.0.26200.9168
Windows Server 2025: fixed in 10.0.26100.33296
After patching
Reboot the machines.
Re-check the build number (or confirm your patch history) to ensure the system is now at one of the fixed versions above.
Workaround if patching is delayed
Reduce the chance of “authorized/local attacker” conditions by tightening local access:
Remove unnecessary local admin rights.
Ensure accounts used on the device are minimally privileged.
Limit who can sign in interactively to those systems.
Monitor for suspicious local activity because this class of bug is most relevant once an attacker can run code locally.
This CVE is not listed in CISA KEV based on the provided findings, and there is no public exploit code on record.
The findings do indicate new press attention tied to patch activity and an actor name (Lazarus group), so you should still treat patching as urgent given the fixed versions are available.
Technical context
What the vulnerability is
CWE-416 (Use after free) in the Windows Kernel.
The underlying mechanism described in the backstop: a use-after-free condition that can be abused to achieve local privilege escalation.
Attack scenario / reachability
The findings state “authorized attacker” and the described outcome is privilege elevation locally. In practice, this means the main risk is when an attacker already has some ability to run code or act locally on the machine.
Exploitation status
Not listed in CISA KEV (per findings).
No public exploit code on record (per findings).
Verdict is still RED due to the kernel privilege escalation nature and reported actor/press attention.
Patch information
Fixed versions are provided by Microsoft for both Windows 11 and Windows Server 2025 (exact build numbers listed in the remediation section).
EPSS
A predicted likelihood value is present in the findings, but public blocks should not repeat it; additionally, KEV/news-style confirmation would override prediction. Here, KEV listing is not present.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
