Windows USB Hub Driver CVE-2026-50479

Exploitation requires the attacker to already have local, authenticated code-execution as a low-privileged user on the target (CVSS AV:L with PR:L) - this is a local elevation-of-privilege flaw, not remotely reachable, so a foothold on the machine is the mandatory precondition. The attacker must be able to interact with the USB Hub Driver, typically via device IOCTLs/APIs available to standard users, and no user interaction from a victim is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the flaw cannot be triggered over the network, it grants no benefit to an attacker who already has admin/SYSTEM, and only the listed Windows 10 and Windows Server 2019-2025 builds are affected; hosts where untrusted users cannot obtain a local session (e.g., single-admin, well-segmented servers) have substantially reduced realistic exposure.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, High) describes a locally exploitable flaw of low attack complexity requiring low privileges and no user interaction, with high impact to all three security properties within an unchanged scope - a classic local elevation-of-privilege profile. No EPSS score and no SSVC decision data were provided, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC was referenced, so this is not a widespread-scanning internet-facing risk. The real-world priority is moderate-to-high in the context of defense-in-depth: EoP bugs are highly valuable as the second stage of an intrusion chain (post-initial-access) and are commonly bundled into malware and red-team toolkits, so despite the local-only vector it should be patched on the normal Patch Tuesday cadence, prioritized on multi-user, RDP, and terminal-server hosts where untrusted users hold local sessions. Note the tag 'Information Disclosure' conflicts with the CVSS impact and the description (which frames this as privilege elevation) - treat the tag as a likely Microsoft catalog artifact and rely on the CVSS/description for impact.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through phishing, a compromised service account, or a standard user on a shared terminal server - runs a crafted program that issues malicious requests to the USB Hub Driver, triggering the untrusted pointer dereference in kernel context. By controlling the dereferenced pointer they corrupt kernel memory to gain SYSTEM privileges, then disable security tooling and move laterally. The low attack complexity and lack of required user interaction make this a reliable second-stage escalation once local code execution is achieved; no public POC was identified at time of analysis.