Windows USB Video Driver CVE-2026-49804

Physical access to the target machine is the hard prerequisite - the attacker must be able to connect a USB device to an exposed port (AV:P). User interaction is required (UI:R per CVSS), which likely means the device enumeration and driver loading process must be triggered, such as by plugging in the device while the system is running and unlocked, or by a logged-in user being present. No prior authentication is needed (PR:N) - the attack operates at the hardware layer before any OS authentication gating. Exploitation is limited to systems with accessible USB ports and the USB Video Class driver loaded or loadable; environments that enforce USB device whitelisting (e.g., allowing only pre-approved USB VID/PID pairs) would block this attack. Physical security controls such as port locks, epoxy-filled ports, or restricted datacenter access are effective mitigations. SSVC Automatable=no confirms this cannot be scripted or delivered remotely at scale.

Despite a CVSS Technical Impact of total (C:H/I:H/A:H) and broad product coverage, real-world risk is substantially gated by the physical access requirement (AV:P). CVSS 6.6 accurately reflects this: the score is capped by the physical vector, not by impact. EPSS 0.37% at the 29th percentile further corroborates low probability of observed exploitation in the wild. SSVC Automatable=no is consistent - an attacker cannot remotely or programmatically trigger this at scale; each attack requires physical USB port access. This vulnerability is most relevant to high-value targets in physically accessible environments: shared workstations, kiosks, point-of-sale terminals, conference room PCs, or servers with exposed USB ports. For standard enterprise endpoints with physical access controls, this is low operational priority relative to network-exploitable vulnerabilities. No conflict between data sources - CVSS vector, EPSS, and SSVC all converge on a physically-limited, non-automated threat.

An attacker with unsupervised physical access to a target Windows machine - such as an unattended corporate laptop, a shared conference room PC, or a kiosk terminal - plugs in a purpose-built USB device that emulates a UVC video device but presents malformed UVC descriptors. When Windows loads the USB Video Driver to handle the new device (triggering the UI:R interaction), the driver overflows a heap buffer while parsing the crafted descriptors, corrupting kernel memory in a manner that allows the attacker to redirect execution and escalate to SYSTEM privileges. No public exploit code has been identified at time of analysis, so a working exploit would require non-trivial kernel exploitation expertise.