Windows USB Driver CVE-2026-69295

Exploitation requires a locally authenticated account with at least low-privilege access (PR:L per CVSS vector) on the target Windows system - any standard domain or local user account qualifies. The attacker must be able to interact with the Windows USB Driver subsystem, which is accessible to all logged-in users by default and does not require special configuration or USB hardware to be physically connected in all exploitation paths. No elevated privileges, administrative rights, special system configuration, or interaction from a second user are required. Exploitation is strictly local (AV:L); an attacker cannot exploit this remotely without first establishing a local authenticated session via another vector. Attack complexity is low (AC:L), meaning no race conditions, heap sprays, or complex timing are required for reliable exploitation.

The CVSS 7.8 score accurately reflects a reliable local privilege escalation: low attack complexity (AC:L) implies no race conditions or complex setup, and low privilege requirement (PR:L) means any authenticated local user - including domain guest or standard accounts - can attempt exploitation. EPSS data was not provided in the input, so exploitation probability cannot be quantified independently. The vulnerability is not listed in CISA KEV and no POC is known at time of analysis, reducing immediate urgency relative to actively exploited LPE chains. However, the breadth of affected versions - spanning consumer Windows 10/11 through enterprise Server 2025, including end-of-support Server 2012 R2 - substantially amplifies organizational exposure. In post-compromise scenarios (e.g., initial access via phishing or credential theft followed by LPE to SYSTEM), this class of flaw is a staple of attacker toolkits. The low complexity is the most operationally significant signal here: defenders should not treat a 7.8 LPE as lower priority than a higher-scored but harder-to-exploit network vulnerability.

An attacker who has obtained a standard low-privileged Windows account - via phishing, credential stuffing, or lateral movement - interacts with the Windows USB Driver interface on an unpatched system, triggering the out-of-bounds read in kernel memory. The disclosed kernel data is used to construct a reliable privilege escalation payload, elevating the attacker's context from the standard user account to SYSTEM without requiring any action from another user. No public exploit code is known at time of analysis.