Windows USB Print Driver CVE-2026-50674

Exploitation requires the attacker to already possess a valid low-privilege local account and the ability to execute code on the target (CVSS PR:L, AV:L), then interact with the Windows USB print driver to trigger the use-after-free. Limiting factors: the attack is purely local - there is no remote or network-reachable path - and it presupposes an existing foothold, so it functions as a second-stage escalation rather than initial compromise; it is not automatable (SSVC Automatable: no) and no user interaction is required (UI:N). Systems where the USB printing driver is disabled or where USB printer-class devices are blocked present a materially reduced or absent attack surface. Only Windows 11 24H2/25H2/26H1 and Windows Server 2025 (including Server Core) are affected.

The signals are internally consistent and point to a genuine but non-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity, low-privilege escalation with full CIA impact - matching the description's 'authorized attacker...elevate privileges locally.' EPSS is low (0.25%, 16th percentile) and CISA SSVC records Exploitation: none and Automatable: no, so there is no evidence of active or scalable exploitation; however SSVC Technical Impact: total confirms the payoff is complete system control if triggered. No KEV listing and no POC exist. The one caveat worth flagging: use-after-free driver bugs are historically favored by local EoP exploit developers, so the low EPSS reflects current absence of public tooling, not intrinsic difficulty - expect risk to rise if a POC emerges. This should be patched on a normal-to-expedited cadence, prioritized above pure-DoS issues because of the code-execution potential but below any network-reachable or actively-exploited flaw.

An attacker who already holds an ordinary authenticated local account (for example via phishing, a stolen credential, or a compromised low-privilege service) runs a crafted program that drives the USB print driver into a use-after-free condition, reclaims the freed kernel object with controlled data, and hijacks execution to run code as SYSTEM. No user interaction or network access is needed, but the attacker must first be logged on locally. No public exploit code is available at time of analysis, so an attacker would need to develop the primitive themselves.