Windows USB Audio CVE-2026-69307

Exploitation requires an existing local user account with at minimum standard (non-administrator) privileges on the target Windows system - confirmed by PR:L in the CVSS vector. The USB Audio Class driver (usbaudio.sys) must be present and loadable, which is the default configuration on all Windows systems with USB support enabled (effectively all consumer and most enterprise endpoints). No USB audio hardware physically needs to be connected if the attack path goes through kernel IOCTLs directly rather than physical device enumeration, though this is not explicitly confirmed by the description. What limits exploitation: the attacker must already have local code execution (AV:L); remote-only attackers cannot reach this vector without a separate initial access step. No special USB device, network position, or non-default configuration setting is required beyond local account access.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is well-calibrated for this class of vulnerability. The low attack complexity and absence of user interaction requirements mean the exploit, once written, is reliable - a significant concern for post-compromise privilege escalation chains. No EPSS score was provided in the input data. This CVE is not listed in the CISA KEV catalog, and no public proof-of-concept exploit is known at time of analysis. Despite the absence of active exploitation, the combination of widespread platform prevalence, broad version coverage (19 distinct SKUs from Server 2012 to Windows 11 26H1), low prerequisite bar (standard local account only), and C:H/I:H/A:H impact should classify this as a high-priority patch for organizations performing vulnerability prioritization. The primary limiting factor is the AV:L constraint - an attacker must already have local code execution, making this a second-stage privilege escalation rather than an initial access vector.

An attacker with a standard domain user account on a Windows endpoint connects or emulates a malicious USB audio device, then sends crafted I/O control requests to usbaudio.sys that trigger the out-of-bounds heap write. This corrupts adjacent kernel heap structures, redirecting execution and granting SYSTEM-level privileges - enabling installation of persistent malware, credential dumping, or lateral movement. No public proof-of-concept exploit exists at time of analysis, but the low complexity rating suggests reliable exploitation once the overflow primitive is identified.