EUVD-2026-44301
GHSA-rg39-8mmh-38h3
Severity by source
AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Physical access mandatory for USB interaction; race condition demands high complexity; low-privilege account required; full system impact if race is won.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges with a physical attack.
AnalysisAI
Privilege escalation in the Windows USB Print Driver affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, exploitable by a physically-present attacker with low-privilege credentials via a race condition in the driver's shared resource handling. The flaw requires both physical device access and precise timing to win the synchronization window, making exploitation non-trivial. No public exploit identified at time of analysis; EPSS stands at 0.17% (7th percentile), and SSVC rates exploitation as none - consistent with high attack complexity and the physical access prerequisite.
Technical ContextAI
The vulnerability is rooted in CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), commonly manifesting as a TOCTOU (Time-of-Check Time-of-Use) or similar race condition within the Windows USB Print Driver. The driver fails to properly synchronize access to a shared resource across concurrent execution contexts, creating an exploitable window. Affected products per CPE include cpe:2.3:a:microsoft:windows_11_version_24h2, windows_11_version_25h2, windows_11_version_26h1, windows_server_2025, and windows_server_2025_(server_core_installation). The USB print subsystem, being a kernel-mode component that interfaces with externally connected hardware, is a natural target for local privilege escalation via timing attacks.
RemediationAI
Vendor-released patch: Microsoft has released updates fixing this issue - apply the relevant cumulative update to reach Windows 11 24H2/25H2 build 10.0.26100.8875 or later, Windows 11 26H1 build 10.0.28000.2525 or later, and Windows Server 2025 build 10.0.26100.33158 or later, as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58543. As a compensating control where patching is delayed, organizations can restrict physical USB device access via Group Policy (Device Installation Restrictions) to block unauthorized USB peripherals, or disable USB print driver functionality if USB printing is not required in the environment - note that disabling USB printing will prevent legitimate printing to USB-connected printers. Physical access controls (locked workstations, restricted server room access) further reduce exposure given the AV:P requirement.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today