Windows USB Print Driver CVE-2026-54991

Exploitation requires the attacker to already hold valid low-privileged local credentials on the target (CVSS PR:L, AV:L) and to interact with the Windows USB Print Driver code path, so the host must have the USB print driver stack present and reachable by the attacker's process - the default state on affected Windows 11 24H2/25H2/26H1 and Windows Server 2025 builds. The key limiting factor is the race condition itself (AC:H): the attacker must repeatedly and precisely time concurrent operations to win a narrow synchronization window, making success probabilistic rather than guaranteed. No user interaction is needed (UI:N), and no network access is possible (local vector only), which confines the threat to attackers who have already gained a foothold on the machine.

The signals align toward a real but not urgent priority. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms a local, authenticated attacker facing high attack complexity - the AC:H reflects the inherent unreliability of winning a race condition, which typically needs many attempts or precise timing. EPSS is low (0.19%, 9th percentile) and CISA SSVC marks exploitation as 'none' and automatable as 'no', which is coherent with a race condition that is hard to weaponize reliably. However, SSVC technical impact is 'total,' matching the C:H/I:H/A:H triad - a successful exploit fully compromises the host. There is no conflict among the signals: this is a genuine local EoP that a patient attacker with a foothold could leverage, but it is not a mass-exploitation or wormable threat. No KEV listing and no POC mean it is not an active-exploitation emergency; prioritize it in normal patch cycles, higher on multi-user or shared hosts.

An attacker who already has a low-privileged foothold on a Windows 11 or Server 2025 host (for example, a standard user account or a compromised service) repeatedly triggers USB print driver operations while racing a second thread to manipulate the shared resource during the vulnerable window. On a successful timing hit, the attacker corrupts privileged state and elevates to SYSTEM, gaining full control of the machine. No public exploit is identified at time of analysis, and the high attack complexity means the attacker may need many attempts to win the race.