CVE-2026-62748

HighCVSS 7.0/10Last modified Aug 18, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Aug 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-627497.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-62756.4The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and inclCVE-2026-627506.5Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network.CVE-2026-627517.8Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.CVE-2026-627527.8Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.CVE-2026-627537.0Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.CVE-2026-627547.8Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.CVE-2026-627557.8Stack-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges locally.CVE-2026-627575.9Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a netCVE-2026-627587.8Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.CVE-2026-627597.5Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.CVE-2026-62767.5Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy
CVE-2026-62748: High severity, CVSS 7.0 | Vulnix