CVE-2026-62768

The CVSS 7.8/EPSS 0.00318 gap on this Windows Installer stack-based buffer overflow deserves more scrutiny than the raw scores provide. The severity rating reflects what happens if exploitation succeeds—a local privilege escalation to SYSTEM context on a domain-joined workstation enables full Active Directory compromise through service account credential decryption. That blast radius is categorically different from a CVSS 7.8 remote code execution with containment constraints. However, the EPSS probability likely undercounts two populations: enterprise red teams treating this as standard post-phishing escalation tooling, and the third-party installer ecosystem that wraps Windows Installer. The 'authorized attacker' qualifier in the CVE description is historically unreliable—Windows Installer privilege escalation CVEs from 2015-2023 consistently showed initial scope underestimation once researchers demonstrated standard user workflows could trigger the vulnerable paths. The mitigation stack analysis requires a critical caveat: Windows Installer carries legacy code paths from its Windows 2000 origins that are explicitly excluded from Control Flow Guard coverage for binary compatibility. A stack overflow surviving into 2025 almost certainly lives in exactly this excluded zone—not because mitigations failed, but because the code path can't be hardened without breaking existing enterprise deployment scripts. The remediation timeline itself becomes a compounding risk factor: patches for CFG-excluded paths require compatibility shims rather than clean fixes, extending the organizational exposure window beyond what a typical CVE timeline would suggest. Prioritize patching on domain controllers, build servers, and any workstation where developers or IT staff run installer workflows—the 'authorized user' population exercising this code path is far larger than the CVE implies, and the SYSTEM-context privilege target means a successful exploit unlocks the entire Active Directory attack surface.

Reviewed through automated stages and approved by a human before publication.