Windows HID Driver CVE-2026-105003

Exploitation requires the attacker to already possess local, authenticated access to the Windows host as a low-privileged user (PR:L) capable of running code and interacting with the HID class driver interface; it cannot be triggered remotely or over a network. No special non-default configuration is indicated - the HID class driver is present by default - but the attack is limited by the need for a pre-existing local foothold and valid (even unprivileged) account access, which materially reduces real-world reach compared with a remote unauthenticated flaw.

This is a local privilege-escalation flaw in the Windows HID class driver with a CVSS 3.1 base score of 7.8. The vector (AV:L/AC:L/PR:L/UI:N/S:U) shows the attacker must already have local access and low-level privileges (an authenticated/authorized user), but exploitation is low-complexity, needs no user interaction, and yields high confidentiality, integrity, and availability impact - the classic profile of a user-to-SYSTEM escalation. No EPSS score, CISA KEV entry, or POC indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals are therefore limited to the CVSS vector alone. Because this requires pre-existing local access, it is not a remote entry point but a post-compromise escalation primitive, typically chained after an initial foothold (phishing, malware, or a low-priv account). Priority should be driven by the ubiquity of the affected Windows component rather than by exploitation telemetry, which is absent here. KEV/EPSS/POC data missing - monitor MSRC and CISA KEV for status changes before assuming only targeted risk.

A local attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account gained via phishing or commodity malware) runs a crafted program that sends malformed HID data to the vulnerable class driver, triggering a heap-based buffer overflow in kernel context. Successful exploitation corrupts kernel heap structures to execute code as SYSTEM, fully compromising the machine. No public exploit code is identified in the provided data.