CVE-2026-62877 is a stack-based buffer overflow in Win32K.sys affecting Windows 10 version 1607, enabling local unprivileged users to escalate to SYSTEM. This is not an isolated defect — it is the latest instance in a fifteen-year pattern of Win32K privilege escalation vulnerabilities, and the pattern tells you more about the real risk than the CVSS 7.8 score does.
The specific vulnerability class matters here. Stack-based buffer overflows in Win32K aren't sophisticated use-after-free bugs from complex state management — they're primitive memory safety violations occurring in performance-critical graphics code paths where developers used fixed-size buffers with insufficient bounds checking. The commit history of previous Win32K CVEs reveals a characteristic signature: partial remediation. Microsoft adds validation to the specific code path tied to a CVE, but leaves adjacent, structurally identical paths untouched because they weren't in scope. This creates a moving target for attackers and guarantees future CVEs in the same component.
The EPSS score of 0.00246 is dangerously misleading for this class of vulnerability. EPSS models mass exploitation probability — the likelihood that automated scanners will hit your perimeter with an exploit. But Win32K vulnerabilities are final-stage payloads in real attacks, deployed after initial access via phishing, credential theft, or exposed services. The victims who matter don't share telemetry about post-exploitation privilege escalation, so the model systematically underweights exactly this scenario. Treat EPSS as a guide to mass exploitation risk, not as a measure of targeted-attack exposure.
The deeper problem is organizational, not technical. Win32K.sys contains code paths that trace back to the Windows 2000 era — original authors have left, their reasoning is undocumented, and current maintainers treat the subsystem as a black box too risky to refactor. The compatibility surface area is enormous: enterprise line-of-business applications depend on Win32K graphics primitives, and aggressive remediation risks breaking applications that generate visible, measurable organizational pain. This creates an asymmetry where the cost of patching is concentrated and vocal, while the cost of leaving the vulnerability unpatched is diffuse and silent until a breach occurs.
Defenders should treat Win32K vulnerabilities differently from typical CVEs. Prioritize kernel patch deployment aggressively regardless of EPSS — the 'low probability' framing applies to mass exploitation, not to the targeted intrusions where local privilege escalation is the goal. If you manage Windows 10 1607 systems specifically, understand that this is a 2016 release no longer in mainstream support, likely running in long-term servicing branches or unmanaged environments where patch latency is already a problem. Assume adversarial access to any unpatched workstation in an environment where phishing or credential compromise is plausible — the privilege escalation step is the expected pivot, not a worst-case surprise.