CVE-2026-62799

This is a heap-based buffer overflow in the Windows SMB Client (CVE-2026-62799), rated CVSS 7.8 but with an EPSS of only 0.00264 — a gap that demands scrutiny from defenders, not complacency. The 'authorized attacker' qualifier is doing critical work in the threat model. It means this is not a wormable remote vector; it's a local privilege escalation path for someone who already has a user session. But the SMB Client context actually widens the realistic attack path: connecting to a hostile share requires no special authorization, just user interaction. A compromised browser tab, a malicious extension, or a weaponized shortcut file opened from a network share can all establish the 'authorized' context without prior credential compromise. If defenders read 'authorized' as 'already has valid domain credentials,' they're applying the wrong threat model. This is at least the fourth or fifth heap overflow in this specific SMB Client code path over the past decade. That pattern should worry you more than the EPSS number. Each recurrence has trained defender workflows to apply the same heuristic — 'authorized attacker, local-only, lower urgency' — and that normalization is its own blast radius. The cumulative effect is that SMB Client has become a known pivot point where both attackers and defenders operate in familiar territory, which depresses organizational urgency even as the attack surface remains live. Windows 11 mitigations like HVCI and ACG have forced attackers to adapt rather than retire these bugs. Heap spraying, relative pointer corruption, and pool grooming have kept heap overflows weaponizable post-mitigations. The low EPSS likely reflects that reliable exploitation requires chaining this with other primitives, not that the window has closed. Prioritize this patch based on your environment's user interaction patterns, not the CVSS alone. Systems where users routinely connect to untrusted network shares face elevated risk. The 'authorized' framing should not delay patching — the temporal debt compounds with each recurrence, and organizations are measurably slower to remediate this vulnerability class than they were when the pattern began. Beyond patching, audit SMB Client usage and disable SMB 1.0 to reduce the 'deprecated but not eradicated' attack surface where these overflows continue to surface.

Reviewed through automated stages and approved by a human before publication.