CVE-2026-62733

The EPSS score of 0.00246 is doing analytical work that deserves scrutiny — this low exploitation probability claim, combined with a Win32K out-of-bounds read in kernel space, creates a tension that shouldn't be resolved by defaulting to 'low priority' based on statistics alone. Win32K.sys has been the most productive source of kernel privilege escalation primitives for over a decade. Every major browser sandbox escape, every ransomware kernel handoff, every APT toolchain that needs to break out of userland has reached for Win32K. The specific class of out-of-bounds read matters: while these don't directly yield code execution, kernel memory reads expose handles, token pointers, and session-state data that enable ASLR bypass and reliable exploitation chains. A 7.8 CVSS reflects the systemic risk, not the standalone severity. The EPSS figure warrants skepticism here. Probability-of-exploitation models historically underweight local privilege escalations because they aren't remotely reachable — the math penalizes them for having a narrow attack surface, not for their role as critical path components in real-world intrusion chains. An attacker with any foothold needs LPE to reach SYSTEM; this CVE provides that path for Windows 10 1607 specifically. The weaponization pipeline is well-documented: local access → this OOB read → kernel handle leak → token pointer exposure → ASLR defeat → reliable SYSTEM. That's not one privilege escalation — it's a fully weaponized pipeline that converts any userland foothold into persistent enterprise compromise. Win32K vulnerabilities also function as correlated failures rather than independent events. EPSS models treat each CVE in isolation, but Win32K's accumulated design debt means that when one primitive becomes available, exploitation chains built on it mature predictably against unpatched populations. The effective exploitation probability isn't the product of independent events — it's the probability of the root condition, which is running unpatched Windows. Windows 10 1607 is analytically significant. It exited extended support in 2026, meaning there are no longer mandatory security update obligations. Organizations still running it are likely doing so because of application compatibility constraints — patching may be complicated or deferred, and the remediation path may involve hardware replacement rather than patching. The vulnerability's actual exposure window could be substantially longer than the EPSS model assumes. The real question isn't whether this specific CVE is actively exploited — it's whether your environment has Win32K attack surface exposed through unpatched 1607 systems, and whether those systems sit in the blast radius of user-to-SYSTEM privilege escalation. The blast radius calculation should include not just this specific path to SYSTEM, but the subsystem-wide attack surface that will generate its replacement when this gets patched.

Reviewed through automated stages and approved by a human before publication.