The Bind Filter Driver heap overflow (CVE-2026-62722) deserves more scrutiny than its 7.8 CVSS suggests—particularly because the EPSS probability of 0.00318 is unusually low for a kernel-mode memory corruption flaw. That gap isn't a reason to dismiss this vulnerability; it's a reason to understand what's driving it.
The critical detail is what the CVE doesn't spell out: this driver processes DNS traffic at the NDIS layer, which means the heap overflow occurs in a context where attackers can control allocation sizes through crafted DNS responses. Record counts, string lengths, and pointer chains in DNS packets give attackers structured, reliable control over kernel heap layout—something that significantly raises the feasibility of exploitation beyond what generic heap overflows offer. The "authorized attacker" qualifier reframes this as post-compromise escalation rather than initial access, but that distinction is less reassuring than it appears: achieving medium integrity is increasingly common via phishing, browser exploits, or insider threats in enterprise environments. Once an attacker has that foothold, this vulnerability becomes a high-reliability privilege escalation path to kernel mode.
The low EPSS likely reflects two factors: the recency of disclosure (EPSS climbs as vulnerabilities age) and the possibility that this code path hasn't yet attracted targeted exploitation development. However, kernel-mode heap overflows in network filter drivers follow a well-documented pattern—Bind Filter isn't an anomaly, it's the latest instance in a lineage of similar vulnerabilities across Windows network stack components. Organizations with high-value network communication transiting Windows endpoints should treat this as a potential infrastructure compromise vector, not merely a local privilege escalation.
Prioritization: patch immediately on endpoints that process DNS resolution for sensitive traffic. Treat the "authorized attacker" constraint as a reminder that this fits into chained exploitation scenarios—assume attackers may already have userland access and are looking for exactly this escalation path.