Windows USB Video Driver CVE-2026-69423

Exploitation requires: (1) the attacker holds a low-privileged account on or with network access to the target system (PR:L); (2) some form of user interaction must occur (UI:R), most plausibly a victim connecting a USB video device or accepting a USB-redirected session; (3) the Windows USB Video Driver is exposed over a network path, which in practice means the host is configured for RDP/RemoteFX USB device redirection or USB-over-IP functionality. Physical USB access alone does not appear to be the intended attack vector per the CVSS AV:N designation. Systems that do not use network-accessible USB video redirection have significantly reduced exposure. The attack is limited to Windows hosts running pre-patch build versions across the affected OS range; fully patched systems are not affected.

The provided CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) places this in high-severity territory. Real-world risk is elevated by the breadth of affected Windows versions and the complete confidentiality/integrity/availability impact, but is moderated by two prerequisites: the attacker must already hold low-privileged credentials (PR:L) and some user interaction is required (UI:R). No CISA KEV listing or public POC exists, which reduces immediate exploitation urgency. The network vector (AV:N) is notable and somewhat counterintuitive for a USB driver - it most plausibly applies to USB redirection over RDP/RemoteFX or USB-over-IP deployments. Organizations using USB device redirection in remote desktop environments should treat this as a higher priority. EPSS data is not present in the input; exploitation probability cannot be independently assessed. The combination of low EPSS signals, no KEV, and PR:L/UI:R constraints suggests this is a real but not imminently weaponized threat.

An attacker with a low-privileged domain or local account in an environment using RDP/RemoteFX USB device redirection crafts malicious data to trigger the USB Video Driver's buffer processing path over the network. When a victim user performs the required interaction - such as connecting a USB video device or opening a redirected device session - the malformed input overflows the heap buffer in the driver, corrupting kernel memory and enabling the attacker to execute code at kernel privilege and achieve full SYSTEM access. No public POC is available at time of analysis, so this scenario requires meaningful exploit development capability.