CVE-2026-62796

Imagine a Windows file system that “reaches for data” in memory while handling files. This bug can let someone who already has a local account read pieces of memory they shouldn’t, potentially including private data. In a business, that could mean exposing sensitive documents or other secrets stored on the machine.

This matters if you run Windows 10, Windows 11, or any listed Windows Server versions on systems where someone untrusted can log in with local user privileges. The finding says the attacker needs local access and valid user privileges, and it’s tied to Windows NTFS file handling. Because it’s local, it’s only a realistic risk when an attacker can reach the machine (e.g., via a legitimate local account) rather than from the internet.

This is a RED issue because a real attacker with local user privileges could steal sensitive information from NTFS, and the report indicates patch-related pressure with actor activity noted in the findings. Even though exploitation details in public reporting aren’t clearly dated, the vulnerability class directly supports damaging local data theft. Patch these systems as a priority and lock down who can sign in locally.

1. Inventory affected OS versions: determine which machines run Windows 10, Windows 11, or the listed Windows Server versions.
2. Verify patch level: for each machine, confirm the Windows “version/build” matches one of the fixed versions below (use your normal patch inventory/reporting tool or Windows update history).
3. Apply the Microsoft fix for CVE-2026-62796 using the corresponding fixed build:
   • Windows 10: fixed in 10.0.14393.9418, 10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663
   • Windows 11: fixed in 10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168, 10.0.28000.2704
   • Windows Server 2012: fixed in 6.2.9200.26280
   • Windows Server 2012 R2: fixed in 6.3.9600.23338
   • Windows Server 2016: fixed in 10.0.14393.9418
4. Upgrade path / breaking-change notes: install the standard Microsoft security update for CVE-2026-62796; do not rely on partial updates.
5. If you cannot patch right away (temporary workaround): immediately reduce the set of people who can obtain local user privileges on these machines (remove unused accounts, audit local admin/user group membership, and prevent untrusted access).
6. Monitoring: watch for unusual local account behavior and sensitive-file access patterns on endpoints where local accounts are plausible; also confirm the update installed successfully and re-check build numbers after reboot.
7. KEV/CISA note: KEV is not listed in the CISA KEV catalog based on the provided findings.

CVE-2026-62796 is an information disclosure vulnerability in Windows NTFS (CWE-125: out-of-bounds read). Mechanism: Windows NTFS file-system handling can read memory outside safe bounds when an authorized local user triggers the vulnerable code path, allowing disclosure of sensitive information locally. Attack vector is local, with low authentication requirements in practice described as “valid user privileges” and no user interaction needed. Exploitation status: no clear dated exploitation claim was found in news reports, and no public exploit code is recorded in the findings; however, the traffic-light verdict is RED and the findings indicate patch-related actor activity (Lazarus group) in PULSE. KEV: not listed in CISA KEV. Patch: Microsoft has fixed specific build numbers listed in the findings and provides the update via the MSRC update guide entry for CVE-2026-62796. (The findings also include an EPSS prediction with a flat trend, but the public blocks do not rely on that for urgency.)