For CVE-2026-62842, the EPSS score of 0.00368 is doing something the CVSS 5.5 rating alone obscures: it tells you this OOB read in Microsoft Office isn't likely to be weaponized in the immediate term. But the gap between that 0.37% exploitation probability and medium severity deserves more scrutiny than a simple 'deprioritize' decision.
The vulnerability lives in a legacy Office format parser — code that hasn't been meaningfully rewritten since the 32-bit era. When Microsoft patches an out-of-bounds read here, they're adding guardrails around a specific call path, not rebuilding the parser. The surrounding memory architecture keeps shifting: heap allocators change, new COM objects get instantiated, internal data structures extend. Today's read of 4 bytes from adjacent memory could become tomorrow's read of a pointer that chains to arbitrary disclosure. The EPSS score captures current attacker cost-benefit calculations. It doesn't capture the structural instability of abandoned code that nobody is actively hardening, only minimally patching.
This matters because OOB reads in Office file format parsers have a documented pattern: dismissed at disclosure as low-severity information disclosure, then later discovered to have been part of an attack chain — sometimes for months before anyone connected the dots. The Follina vulnerability followed this exact script. The low EPSS score is a snapshot of a specific moment: no active exploitation chain exists yet. But the genealogical record of this vulnerability class shows they get revisited post-disclosure as components in chained campaigns.
Your triage decision should hinge on two questions. First: does your threat model include phishing-driven document attacks? If yes, the user-interaction requirement (opening a malicious file) isn't a mitigating factor — it's the attack vector. Second: what's your patch velocity? If this sits in the queue for 30 days while surrounding system conditions drift, the conditional probability of exploitation shifts in ways the static EPSS score doesn't capture. The 30-day SLA for CVSS 5.5 isn't just a compliance metric — it's a predictable exposure window that compounds with every week the patch remains unwritten. For legacy code in a widely deployed product, treat the low EPSS as a reason to analyze the attack surface expansion risk, not as a reason to deprioritize.