Windows USB Driver CVE-2026-61926

Exploitation requires a local, authenticated session on the target system with at minimum a standard low-privileged user account (PR:L per CVSS vector). No elevation, administrative rights, or domain membership is required to initiate the attack. The Windows USB driver is loaded by default on all affected Windows versions regardless of whether any USB device is physically connected, so no special hardware configuration or optional feature needs to be enabled. Exploitation is limited to the local machine (AV:L) - remote unauthenticated exploitation is not possible. The only effective limiting factor is the requirement for prior local code execution as any non-anonymous user; remote attackers must first achieve this foothold through a separate mechanism.

The 7.8 CVSS base score accurately reflects the real-world priority of this flaw. The local attack vector (AV:L) limits the attack surface to systems where an adversary already holds a low-privileged interactive or remote session, making this a classic post-exploitation privilege escalation primitive rather than an initial-access vector. The low attack complexity (AC:L) and absence of user interaction (UI:N) mean that once initial access is established, elevating to SYSTEM is straightforward and automatable. No EPSS score was included in the available intelligence, and the vulnerability has not appeared in the CISA KEV catalog at time of analysis, suggesting exploitation has not been widely observed in the wild; however, the absence of KEV listing does not diminish urgency given the vulnerability class - kernel heap overflows in widely deployed OS components have a strong historical precedent for rapid weaponization after public disclosure. The breadth of affected versions (19 distinct Windows SKUs from Server 2012 to Windows 11 26H1) substantially increases aggregate organizational exposure: even a mid-sized municipal IT team in zabrze managing a mixed Windows estate should treat this as urgent patching work. No conflicting signals between CVSS and description were identified; the local vector is consistent with the privilege-escalation-only impact.

An attacker who has obtained a low-privileged user session on a target Windows system - via phishing, credential theft, or exploitation of another vulnerability - crafts a malicious I/O control request targeting the vulnerable USB driver component. Submitting this request triggers the heap-based buffer overflow, overwriting critical kernel heap structures and redirecting execution to attacker-controlled code running at SYSTEM privilege. No public proof-of-concept is currently known, but the AC:L rating indicates the heap corruption primitive is straightforward to trigger without complex heap grooming or timing dependencies.