USB Video Driver CVE-2025-55676

Exploitation requires the attacker to already have local, authenticated access to an affected host (PR:L, AV:L) running the Windows USB Video Driver on Windows 11 24H2, Windows 11 25H2, or Windows Server 2025. The attacker must be able to interact with the USB Video Driver to induce the error condition that leaks data; no user interaction by a victim is required (UI:N). Limiting factors: there is no network vector, so remote exploitation is not possible; prior valid credentials on the machine are needed; and the impact is confined to disclosure of information (no code execution, modification, or denial of service). The affected driver must be present and reachable, which it is by default on these Windows builds.

This is a moderate-severity local information-disclosure flaw (CVSS 5.5) in the Windows USB Video Driver (CWE-209, sensitive data in error messages). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent and aligns with the description: AV:L confirms local access, PR:L confirms an authenticated low-privileged attacker, and C:H/I:N/A:N correctly reflects a pure confidentiality impact with no integrity or availability effect. The EPSS score of 0.66% (51st percentile) indicates low near-term exploitation probability, and there is no CISA KEV listing and no public exploit identified at time of analysis - so no signals point to active exploitation. The signals are therefore mutually reinforcing rather than conflicting: a genuinely local, authenticated, confidentiality-only bug with no exploitation evidence. There is no SSVC decision data, no automatable determination, and no POC in the input. Net assessment: this is a low-priority, high-CVSS-only-in-the-sense-of-'medium' issue for most environments - real-world risk is limited by the local access and prior authentication requirements, and it is best handled through routine patch cycles rather than emergency remediation. One caveat: the specific nature of the 'sensitive information' disclosed (e.g., kernel memory addresses versus user data) is not described, so defenders cannot fully gauge downstream value - verify with the Microsoft advisory.

A low-privileged but authenticated local user on a Windows 11 24H2/25H2 or Windows Server 2025 host interacts with the USB Video Driver (e.g., via a connected or emulated USB video device) in a way that triggers an error condition. The resulting verbose error message leaks sensitive information the attacker is not authorized to see, which could be used to aid further local privilege-escalation efforts. No public exploit code is identified, and exploitation requires the attacker to already have local, authenticated access.