Microsoft Windows CVE-2026-68839

Exploitation requires the target to process an attacker-controlled USB mass-storage device through the Windows USB Mass Storage Class Driver - i.e., a malicious or emulated USB storage device must be attached or presented (physically, via BadUSB emulation, or through USB-over-IP/VDI redirection); the malformed device descriptor then triggers the heap overflow during enumeration. Microsoft's vector marks PR:N/UI:N (no credentials, no user interaction), so on an unlocked or auto-enumerating system merely attaching the device suffices. The primary limiting factor is device presentation: despite the AV:N/'over a network' labeling, the vulnerable code is a USB device-class driver, so realistic exploitation depends on proximate/physical device access or a USB-redirection channel rather than direct internet reachability - verify the true vector against the MSRC advisory.

The published CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) presents this as a trivially remote, unauthenticated, no-interaction RCE, which would make it a top-tier priority. However, this signal conflicts with the affected component: a USB Mass Storage Class Driver is exercised when a physical or emulated USB device is attached, which normally implies AV:P (physical) or AV:L rather than AV:N - a well-documented recurring discrepancy in Microsoft USB-driver CVEs. This conflict should be verified against the MSRC advisory before treating it as a network-wormable bug; realistic exploitation almost certainly requires attaching a malicious USB device (or a compromised USB-over-IP/BadUSB emulation path). EPSS is not provided, KEV=NO, and no POC is indicated, so there is no evidence of active or imminent widespread exploitation. Net: patch broadly because the product footprint is universal and the impact is SYSTEM code execution, but the true attack vector is likely physical/proximate, not internet-facing - treat the 9.8/AV:N as overstated pending vendor confirmation.

An attacker who can present a USB mass-storage device to a target - by physically inserting a malicious/BadUSB-style device, or via a redirected USB-over-IP/VDI session - supplies a malformed storage descriptor that overflows a kernel heap buffer during enumeration, executing code as SYSTEM. No user login or authentication is required beyond the ability to attach the device. No public POC is identified at time of analysis, but the kernel-context RCE impact makes this attractive for supply-chain, evil-maid, or insider scenarios.