CVE detail
CVE-2026-62728
Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 13.9 · diversity 8.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 3
- within the 30d window
- Peak daily
- 3
- highest bucket
Evidence
Source links by recency
3 source links · newest first
ktop browser security patches so far this month. SharePoint: critical RCE chain by Rapid7 Today sees the publication of CVE-2026-63520 , a high-severity remote code execution in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer , and published today in coordination with Microsoft; this vulnerability is the se
vendorwww.rapid7.comAug 11, 2026, 9:10 PM- The August 2026 Security Update ReviewZero Day Initiative
g actively exploited, at least as 0-days. Again, we’ll start with the bug under active attack and move on from there. - CVE-2026-68820 - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability This bug allows attackers to execute code at SYSTEM level. Bugs of this type are often paired with code execution bugs to take over a
vendorwww.thezdi.comAug 11, 2026, 5:56 PM - CVE-2026-62728 Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft MSRC
Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
vendormsrc.microsoft.comAug 11, 2026, 2:00 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2024-32482CVSS 2.2 · Low
The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over t…
- CVE-2020-3981CVSS 5.8 · Medium
VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before ESXi650-202007101-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-…
- CVE-2026-12234CVSS 7.8 · High
The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-…
- CVE-2026-12232CVSS 6.1 · Medium
The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The va…
- CVE-2026-18694CVSS 7.1 · High
An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later pr…
- CVE-2026-18688CVSS 7.1 · High
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a…