Windows USB Print Driver CVE-2026-49806

Exploitation requires local, authenticated access to the target (CVSS PR:L, AV:L) - the attacker must already be able to run code as a low-privileged user on the machine. The specific trigger is the Windows USB Print Driver code path, so the print/USB-print components must be present and reachable by the attacker's process. The dominant limiting factor is the race condition itself (AC:H): the attacker must reliably win a narrow timing window between concurrent threads accessing the shared resource, which is non-deterministic and typically needs repeated attempts; no user interaction is required (UI:N) and no network access is possible (local vector only).

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a local, low-privilege, high-complexity attack with full CIA impact - a classic local elevation-of-privilege profile. The AC:H and AV:L metrics are the key risk dampeners: an attacker must already have a foothold on the box and must reliably win a race condition, which is non-deterministic and typically requires many attempts. There is no CISA KEV listing and no public exploit identified, so this is not an active-exploitation emergency; however, USB print driver EoP bugs are attractive as sandbox-escape or post-compromise privilege chains, so it should be patched on the normal Patch Tuesday cadence rather than deferred. One data inconsistency to flag: the intelligence tags include 'Information Disclosure', but the description and CVSS (C:H/I:H/A:H) describe local privilege elevation - treat this as an EoP flaw and verify the exact impact against the Microsoft advisory.

An attacker who already holds an ordinary user account or a low-privilege process on a Windows 11 24H2 or Windows Server 2025 host repeatedly triggers USB print driver operations while racing a second thread to hit the unsynchronized shared-resource window. On a successful race they corrupt privileged state and gain SYSTEM-level code execution, turning a limited foothold into full host control. No public proof-of-concept has been identified, and the high attack complexity means success typically requires many timing attempts.