EUVD-2026-44017
GHSA-mr77-3w6c-769w
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with an existing low-privileged account (AV:L/PR:L), timing-dependent race gives AC:H, no user interaction, and a successful win yields full SYSTEM-level C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows USB Print Driver affecting Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated, low-privileged user win a race condition (CWE-362) in the driver to gain higher privileges. Microsoft has released a patch and reported the flaw itself; there is no public exploit identified at time of analysis. The high attack complexity (AC:H) reflects the timing-dependent nature of exploiting the shared-resource synchronization defect.
Technical ContextAI
The vulnerability lives in the Windows USB print class driver, a kernel-mode/privileged component that manages USB-attached printer devices. The root cause is CWE-362, a race condition arising from concurrent execution using a shared resource with improper synchronization: two or more threads access shared driver state (e.g., device or job structures) without adequate locking, creating a window in which state can be manipulated between a check and a use (a TOCTOU-style flaw). Because the driver runs with SYSTEM/kernel privileges while accepting operations initiated by lower-privileged users interacting with print/USB device handling, successfully corrupting that shared state during the race lets an attacker's low-privileged context influence privileged execution. The CPE data confirms the affected surface is the Microsoft OS itself across Windows 11 Version 24H2, 25H2, 26H1, Windows Server 2025, and Windows Server 2025 Server Core.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-54996 to all affected SKUs (Windows 11 24H2/25H2/26H1 and Windows Server 2025 including Server Core) as the primary and complete fix - the exact KB/build is listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54996. Because exploitation requires an authenticated local account, an interim compensating control on systems that cannot patch immediately is to restrict local logon and interactive access to trusted users only, reducing the population able to run the exploit; note this does not help on shared or multi-tenant hosts. Where USB printing is not needed, disabling or restricting USB device installation for the printer class via Group Policy (Device Installation Restrictions) reduces reachable attack surface, with the trade-off that legitimate USB printer connections will be blocked. These controls only narrow exposure and are not a substitute for the update.
More in Windows 11 Version 24H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today