CVE-2026-62780

The CVSS-EPSS gap on CVE-2026-62780 is more analytically useful than the use-after-free itself. This Windows 11 23H2 kernel UAF carries a 7.0 severity rating — kernel code, privilege escalation, no user interaction required — yet its EPSS score sits below 0.003, meaning empirical exploitability data shows essentially zero in-the-wild activity. That dissonance is the signal, not the vulnerability. CVSS and EPSS measure different temporal slices. CVSS asks what the worst case is if exploited; EPSS asks whether exploitation has actually materialized. For local kernel UAFs, this gap isn't an anomaly — it's a structural pattern that's recurred across kernel-to-userland escalations (2019), Hyper-V vulnerabilities (2021), and Windows animation flaws (2023). The gap is working as designed, just on different time horizons. For defenders, the practical barriers are substantial: SMEP, KASLR, HVCI, and the difficulty of reliable exploitation across 23H2's patch states make this a high-complexity target. But treating EPSS's "essentially zero" as a stable verdict is dangerous. HVCI bypasses surface quarterly. When a reliable exploitation path matures, EPSS will update — but by then, defenders who deprioritized based on that score are already in the gap. The organizational failure isn't choosing CVSS or EPSS — it's that neither captures exploitability trajectory. What you need is a third signal: how close is reliable exploitation to maturity, and what's the window between that and patch deployment? When these scores diverge this dramatically on kernel vulnerabilities, defaulting to CVSS severity creates systematic over-investment in hard-to-exploit paths while genuinely reachable attack paths get less attention. But don't dismiss the local-only requirement too quickly — if an attacker already has code execution through a separate vector, this UAF may be the difference between a contained incident and domain compromise. The prerequisite you're calling "the harder problem" might already be solved. Track these vulnerabilities by family, not by individual CVE. The half-life of a kernel UAF's exploitability isn't in EPSS or CVSS — it's in how many unpatched systems persist when mitigation landscapes shift, or when a driver signing bypass surfaces. The vulnerability isn't static; it's waiting.

Reviewed through automated stages and approved by a human before publication.