EUVD-2026-22611
GHSA-gj4f-xcvc-q45w
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
5DescriptionCVE.org
Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
AnalysisAI
Heap-based buffer overflow in Windows USB Print Driver allows local privilege escalation via physical device access. Affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, with patch available from Microsoft. Attack requires physical USB access and no user interaction; no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability exists in the Windows USB Print Driver, a core component handling communication with USB-connected printers and print devices. The root cause is a heap-based buffer overflow (CWE-122), where the driver fails to properly validate input data size before writing to heap memory during USB device communication. This allows an attacker with physical access to a USB port to craft a malicious USB device that sends oversized data packets, overwriting adjacent heap structures. The affected CPE identifiers span multiple Windows 11 versions (24H2, 25H2, 26H1) and Windows Server 2025 deployments, indicating the vulnerability affects the current mainstream Windows operating system family across consumer and enterprise SKUs.
RemediationAI
Apply the latest security updates from Microsoft for affected systems. For Windows 11 Version 24H2 and Windows Server 2025, update to build 10.0.26100.32690 or later. For Windows 11 Version 25H2, update to build 10.0.26200.8246 or later. For Windows 11 Version 26H1, update to build 10.0.28000.1836 or later. Updates are available through Windows Update, WSUS, and the Microsoft Update Catalog. Organizations should prioritize patching systems in environments with public or unsecured physical access (kiosks, shared labs, reception areas). Additional mitigation includes implementing physical access controls to USB ports (USB port locks, disabled USB ports via BIOS) and monitoring for suspicious USB device connections.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today