CVE-2026-62782 is a medium severity (CVSS 6.5) out-of-bounds read in the Windows SMB Client. An unauthenticated remote attacker can disclose information when a user takes an action, such as connecting to a share. Microsoft's update guide lists the fix for each Windows build.
What's affected
The record lists several Windows 10 releases (1607, 1809 and 21H2 among them) as affected; the Microsoft entry has the complete list and the KB for each. The weaknesses are CWE-125, an out-of-bounds read.
The vector is network based, low complexity, no privileges and user interaction required. Confidentiality impact is high; integrity and availability are not affected. This is the client side of SMB: the risk is to a machine that connects to a file server, not to the server itself.
No fixed build number appears in the record, so use the Microsoft entry.
How to check if you're exposed
List the latest installed updates and compare them with Microsoft's KB for your Windows version.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
Get-SmbConnection
Get-SmbConnection shows which servers a machine is connected to right now. Unfamiliar SMB servers, especially outside your network, are worth investigating on any machine, patched or not.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Find the KB for each Windows version in Microsoft's entry for this CVE.
- Deploy the update to workstations and servers that act as SMB clients, which is almost everything.
- Block outbound SMB (TCP 445) at the network edge if you do not already. Clients should talk to file servers you run, not to arbitrary hosts.
- Confirm rollout with a patch compliance report.
- Remind users not to open shortcut or link files that point at unfamiliar network shares.
Why it matters
An out-of-bounds read lets a program see memory next to the buffer it meant to read. For a network client the data came from the other side of a connection, so a hostile server can shape what the client mishandles. The result here is information disclosure, not code execution.
SMB is on nearly every Windows machine, so even a medium score covers a very large fleet. The class is CWE-125. The record does not mark the CVE as exploited in the wild and it is not in CISA KEV.
Quick check
Does blocking port 445 outbound help?
It reduces the chance a client reaches an attacker controlled server, so it is a sensible layer. It does not replace the update.
Sources
Last reviewed: 18 October 2026.
