Intel

CVE-2026-62823

microsoft windows_10_1607: Heap-basierter Pufferueberlauf

highEPSS 0.5%

Affected

  • microsoft/windows_10_1607 lt *..10.0.14393.9418
  • microsoft/windows_10_1607 lt *..10.0.14393.9418
  • microsoft/windows_10_1809 lt *..10.0.17763.9115
  • microsoft/windows_10_1809 lt *..10.0.17763.9115
  • microsoft/windows_server_2012 lt *..6.2.9200.26280
  • microsoft/windows_server_2016 lt *..10.0.14393.9418
  • microsoft/windows_server_2019 lt *..10.0.17763.9115
  • microsoft/windows_server_2022 lt *..10.0.20348.5440
  • microsoft/windows_server_2025 lt *..10.0.26100.33222

Description

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

Source: cvelistv5NVD (NIST)Microsoft Security Update GuideBSI WID PortalBSI CSAF

Affected operating systems

  • windows

    microsoft / windows_10_1607

  • windows

    microsoft / windows_10_1809

  • windows

    microsoft / windows_server_2012r2

  • windows

    microsoft / windows_server_2012

  • windows

    microsoft / windows_server_2016

  • windows

    microsoft / windows_server_2019

  • windows

    microsoft / windows_server_2022

  • windows

    microsoft / windows_server_2025

Metrics

XIEM Effective CVSS
8.8
Source: nvd-v3
EPSS percentile
43.4 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
84.08
Exploit maturity
no public PoC known
CVSS v3
8.8
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-08-11 17:06 UTC
CWE
CWE-122

Weakness classes (CWE)

  • CWE-122Variant

    Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-02 18:20 UTC· secure@microsoft.com
    • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/62xxx/CVE-2026-62823.json">CVE-2026-62823</a>
    • Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62823
    • Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62823
    • Reference Type: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62823 Types: Vendor Advisory
  2. CVE Modified2026-08-16 19:17 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012 (+10) → Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012 (+10)
  3. Initial Analysis2026-08-14 15:24 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.9418 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.9418 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.17763.9115 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.17763.9115 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.9418 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.9115 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.5440 *cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.26100.33222 *cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* versions up to (excluding) 6.2.9200.26280
    • Reference Type: Microsoft Corporation: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62823 Types: Vendor Advisory
  4. CVE Modified2026-08-11 22:18 UTC· secure@microsoft.com
    • Affected: Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012 (+10) → Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012 (+10)
  5. CVE Modified2026-08-11 19:18 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-62823","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…

Linked advisories