Microsoft Windows UMPDDrvRealizeBrush Vulnerability Allows Local Privilege Escalation
A local privilege escalation vulnerability in Microsoft Windows, tracked as CVE-2026-62712, allows attackers with initial low-privileged access to gain elevated system privileges.
Zero Day Initiative (ZDI) has disclosed a significant local privilege escalation vulnerability affecting Microsoft Windows, identified as ZDI-26-621 and assigned CVE-2026-62712. This flaw resides within the UMPDDrvRealizeBrush component of the operating system.
To exploit this vulnerability, an attacker must first achieve a foothold on the target system with low-privileged code execution capabilities. Once this initial access is secured, the attacker can then leverage the UMPDDrvRealizeBrush flaw to escalate their privileges to a higher level, potentially gaining administrative control over the affected machine.
The Zero Day Initiative has assigned a CVSS (Common Vulnerability Scoring System) score of 7.8 to this vulnerability, classifying it as 'High' severity. This score indicates a substantial risk to systems that remain unpatched or unprotected against this specific threat.
The vulnerability specifically targets the UMPDDrvRealizeBrush component, which is part of the graphics subsystem in Windows. While the exact technical details of the improper object management are not fully disclosed by ZDI, such flaws often involve race conditions or improper handling of object lifetimes, allowing an attacker to manipulate memory or system state to achieve privilege escalation.
Successful exploitation could grant an attacker the ability to install programs, view, alter, or delete data, and create new accounts with full user rights. This level of access could be used to further compromise the system, deploy malware, or move laterally within a network.
As this is a local privilege escalation vulnerability, it is most dangerous when an attacker already has some level of access to a machine, such as through a phishing attack that installs a low-privileged backdoor or a malware infection. It allows that initial compromise to be deepened into a more impactful one.
Microsoft is expected to address this vulnerability through its regular security update cycle. Users and organizations are strongly advised to apply any available patches from Microsoft as soon as they are released to mitigate the risk posed by CVE-2026-62712. Until patches are available, system administrators should monitor for suspicious activity indicative of privilege escalation attempts.
This disclosure underscores the ongoing need for robust endpoint security measures and prompt patching of operating system vulnerabilities. Even seemingly minor components can harbor critical flaws that attackers can chain together to achieve significant system compromise.
This advisory from the Zero Day Initiative provides further technical details on CVE-2026-62712, a local privilege escalation vulnerability within the UMPDDrvPlgBlt component of Microsoft Windows. The vulnerability requires an attacker to first achieve low-privileged code execution on the target system, and has been assigned a CVSS score of 7.8.
The Zero Day Initiative advisory ZDI-26-619 provides further technical details on CVE-2026-62712, a local privilege escalation vulnerability within Microsoft Windows' UMPDDrvStretchBltROP component. This advisory confirms the CVSS score of 7.8 and reiterates that exploitation requires prior low-privileged code execution on the target system.
This new advisory from Zero Day Initiative details a local privilege escalation vulnerability in Microsoft Windows, specifically within the UMPDDrvStretchBlt component. While the existing story covers CVE-2026-62712 and its general impact, this article provides the specific ZDI advisory number (ZDI-26-618) and confirms the CVSS score of 7.8, reinforcing the high severity of this flaw.