CVE-2026-62739

A CVSS 7.8 heap overflow in HTTP.sys with an EPSS score of 0.00246 — roughly the 3rd percentile of 30-day exploitation likelihood — creates a triage puzzle worth solving. The gap isn't a scoring anomaly; it's a signal about how this vulnerability class behaves in the wild that your prioritization pipeline probably isn't reading. The "authorized attacker" qualifier is doing too much work in standard triage. Yes, this requires local access — but HTTP.sys sits on the path between untrusted network input and kernel-mode execution. An attacker who already has local access on a web-facing server is at a junction point the original Windows trust model assumed was inside the perimeter. That assumption hasrotted. The marginal barrier "local access required" creates is smaller than the CVSS vector suggests in any environment where that system handles external traffic. More importantly, this isn't a one-off. Heap corruption in kernel-adjacent drivers that reached stability during the Windows Vista/7 era — HTTP.sys, NDIS drivers in 2019, kernel-mode printing subsystems in 2021-22 — follow a documented pattern: CVE databases quiet down, EPSS deprioritizes them, patch cadence slips, and the prerequisite barrier erodes faster than the models predict. The "authorized attacker" qualifier is a temporal reprieve, not a permanent risk reduction. When these drivers do get exploited, the exploitation timeline compresses faster than EPSS's backward-looking model captures, and the blast radius exceeds the standalone CVSS score because they're sitting at trust boundaries the original architecture never designed for modern attacker tooling. For your prioritization pipeline: treat HIGH CVSS / LOW EPSS on legacy kernel-adjacent drivers as a specific risk profile — not a reason to deprioritize, but a signal that standard EPSS-adjusted scoring may underweight the temporal and cascade risk. These aren't standard vulnerabilities to triage with the same heuristics as remote unauthenticated web bugs. The patch cadence question isn't whether to treat it as routine — it's recognizing that deferring this class compounds risk in ways that simple severity scoring misses.

Reviewed through automated stages and approved by a human before publication.