What is the CVSS score of CVE-2026-32223?

CVE-2026-32223 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-32223?

Yes, a patch is available for CVE-2026-32223. Update the affected software to the latest version immediately.

Microsoft CVE-2026-32223

EUVD-2026-22611 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-04-14 microsoft

GHSA-gj4f-xcvc-q45w

Heap Overflow Buffer Overflow Microsoft

6.8

CVSS 3.1 · NVD

Temporal: 5.9

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

5.9 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22611

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

MEDIUM 6.8

DescriptionCVE.org

Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.

AnalysisAI

Heap-based buffer overflow in Windows USB Print Driver allows local privilege escalation via physical device access. Affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, with patch available from Microsoft. Attack requires physical USB access and no user interaction; no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability exists in the Windows USB Print Driver, a core component handling communication with USB-connected printers and print devices. The root cause is a heap-based buffer overflow (CWE-122), where the driver fails to properly validate input data size before writing to heap memory during USB device communication. This allows an attacker with physical access to a USB port to craft a malicious USB device that sends oversized data packets, overwriting adjacent heap structures. The affected CPE identifiers span multiple Windows 11 versions (24H2, 25H2, 26H1) and Windows Server 2025 deployments, indicating the vulnerability affects the current mainstream Windows operating system family across consumer and enterprise SKUs.

RemediationAI

Apply the latest security updates from Microsoft for affected systems. For Windows 11 Version 24H2 and Windows Server 2025, update to build 10.0.26100.32690 or later. For Windows 11 Version 25H2, update to build 10.0.26200.8246 or later. For Windows 11 Version 26H1, update to build 10.0.28000.1836 or later. Updates are available through Windows Update, WSUS, and the Microsoft Update Catalog. Organizations should prioritize patching systems in environments with public or unsecured physical access (kiosks, shared labs, reception areas). Additional mitigation includes implementing physical access controls to USB ports (USB port locks, disabled USB ports via BIOS) and monitoring for suspicious USB device connections.