Windows USB Audio CVE-2026-69286

Exploitation requires a local interactive session or existing code execution with at least low (user-level) privileges on the target Windows system, consistent with the CVSS PR:L rating. The attack surface exists when the USB Audio Class driver (usbaudio.sys) is loaded, which typically occurs when a USB audio device is attached. Remote or network-based exploitation is not possible given the local-only attack vector (AV:L). No elevated privileges, no user interaction from another user, and no special non-default configuration are required beyond local access. Limiting factors for defenders: physical or policy-enforced USB audio device restrictions eliminate the driver surface entirely; environments without USB audio devices in use are not exposed to usbaudio.sys-based attack paths.

The CVSS 3.1 medium score of 5.5 accurately characterizes the constrained threat model: the local attack vector (AV:L) and low-privilege requirement (PR:L) mean an attacker must already possess an interactive session or code execution on the target, which precludes remote or unauthenticated exploitation. The high confidentiality impact (C:H) is meaningful - kernel driver out-of-bounds reads can expose sensitive memory across address-space boundaries - but the absence of integrity or availability impact (I:N/A:N) limits total blast radius to information disclosure. No CISA KEV listing and no public exploit code further reduce urgency relative to remotely exploitable vulnerabilities. The very broad affected version range (Server 2012 through current Windows 11 builds, including Server Core variants) increases total patch surface and makes deployment operationally significant even though individual exploitation probability remains moderate.

A local attacker with a standard user account on a Windows system submits crafted I/O control requests to the usbaudio.sys kernel driver - facilitated by attaching a USB audio device or interacting with the driver directly - triggering an out-of-bounds memory read that returns kernel address space contents to user space. The disclosed data could include credentials, session tokens, or other sensitive material resident in kernel memory. No public exploit code has been identified at time of analysis.