Zero Radar
← feed
HighVulnerabilityCVE-2026-62877updated 28 Oct 2026, 20:27 UTC

Windows Win32k flaw lets a local user gain higher privileges

A bug in a core part of Windows lets someone who already has a login on the computer gain administrator-level control. Outsiders cannot use it alone, but it can be used after they get a foothold.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesInstall the latest Microsoft security updates for Windows and Office, as listed in the Microsoft Security Update Guide for CVE-2026-62877. · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Local user accessAttacker already has a login on the PC
  2. 2Trigger Win32k bugCrafted input overflows a kernel buffer
  3. 3Kernel code runsOverflow hijacks privileged system code
  4. 4Admin rights gainedAttacker elevates to SYSTEM level
  5. ResultAttacker controls the Windows machine

What happened

A stack-based buffer overflow in the Windows Win32k kernel component allows an authorized local attacker to elevate privileges. Microsoft also lists supported editions of Microsoft Office as affected.

Why it is dangerous: Once an attacker gets any local access, such as through a phishing email or stolen password, this flaw can give them full control of the machine. Shared computers and servers with many local users carry the most risk.

Are you affected?

You are affected if you run a supported Windows edition or a supported edition of Microsoft Office that has not received the October 2026 security update.

Supported Windows editions; supported editions of Microsoft Office (exact versions not stated in the material).

What to do

  1. Install the latest Windows security update from Microsoft, which includes the fix for CVE-2026-62877.
  2. Install the latest security updates for all supported Microsoft Office editions.
  3. Restart the computer after updating so the fix takes effect.

Timeline

  1. 11 Aug 2026, 17:18 UTC
    Publicly disclosed
  2. 28 Oct 2026, 14:00 UTC
    Reported by Microsoft MSRC · Microsoft MSRC
  3. 28 Oct 2026, 20:07 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 20:27 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-62877
CVSS
7.8 / 10
Disclosed
11 Aug 2026, 17:18 UTC
On Zero Radar
28 Oct 2026, 20:07 UTC (78 days after disclosure)
Last change
28 Oct 2026, 20:27 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Windows Win32k flaw lets a local user gain higher privileges · Zero Radar