Windows USB Audio CVE-2026-58528

Exploitation requires the attacker to have direct physical access to the target machine and specifically to an exposed USB port - a hard prerequisite that eliminates all remote and network-based attack paths. The attacker must connect a specially crafted USB audio class device; the driver loads and processes device descriptors automatically upon connection, requiring no interaction from a logged-in user and no operating system authentication (the vulnerability triggers at the driver enumeration layer, below OS login). No special Windows configuration or non-default feature enablement is required, as usbaudio.sys is present on all affected Windows installations and loads on demand when any USB audio device is connected. The primary factors limiting exploitation are: physical access requirement (not automatable, not remotely exploitable), the absence of write or execution capability (information disclosure only), and the need for a crafted device rather than an off-the-shelf USB peripheral. Systems with USB port lockdown policies, device installation restrictions blocking unauthorized USB Audio Class hardware, or strong physical security controls are not practically exploitable.

The CVSS base score of 4.6 (Medium) with vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately characterizes the dominant constraint: mandatory physical proximity. EPSS at 0.42% (34th percentile) corroborates low exploitation likelihood in practice, as physical access barriers eliminate network-scalable attack paths. SSVC rates Exploitation as 'none' and Automatable as 'no,' consistent with the physical vector, but rates Technical Impact as 'total' - reflecting the potential for full kernel memory disclosure (C:H) when the flaw is triggered. This tension between low CVSS score and SSVC 'total' technical impact is not a conflict: the impact ceiling is high, but the access requirement is severe. Real-world priority is elevated for high-assurance environments - air-gapped workstations, shared kiosks, government endpoints, or any setting where untrusted individuals may briefly access USB ports - but is low for typical enterprise endpoints protected by strong physical security. No CVSS-to-description inconsistency detected; the physical vector is well-supported by the 'physical attack' language in the description.

An attacker with brief unsupervised physical access to an unpatched Windows endpoint - such as a shared workstation, conference room PC, or unattended kiosk - connects a purpose-built malicious USB audio device to an exposed port. During automatic USB enumeration, usbaudio.sys processes the device's crafted descriptors, triggering an out-of-bounds read that leaks contents of kernel memory to the device or a co-located capture mechanism. The leaked data could include residual credentials, cryptographic keying material, or other sensitive information present in kernel memory at that moment. No public proof-of-concept exploit code has been identified at time of analysis.