## Summary
CVE-2026-62889 is a high-severity issue involving a double free vulnerability in the Windows Secure Socket Tunneling Protocol (SSTP). The NVD description states that a remote, unauthorized attacker can leverage this flaw to execute code over a network.
## Technical Details
- Vulnerability type: Double free
- Affected component: Windows Secure Socket Tunneling Protocol (SSTP)
- CWE: CWE-415
- Impact described by NVD: remote code execution (RCE) over the network
- CVSS (as provided): 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
## Affected
- Windows Secure Socket Tunneling Protocol (SSTP)
## Impact
- Remote attacker can potentially achieve code execution via a double-free condition in SSTP.
- Confidentiality, integrity, and availability impact are indicated as high in the provided CVSS metrics (C:H, I:H, A:H).
## Mitigation
1. Apply vendor security updates/patches for the affected Windows SSTP component as soon as they are available.
2. Reduce exposure by limiting network access to SSTP endpoints (e.g., restrict inbound connectivity at firewalls/VPN gateways).
3. Monitor for anomalous SSTP traffic patterns consistent with exploitation attempts, and investigate crashes/restarts of network services handling SSTP.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-415