Windows USB Audio CVE-2026-69469

Physical access to the target machine is mandatory (CVSS AV:P); this cannot be exploited remotely under any configuration. The attacker must present a specially crafted USB audio device to the host's USB port - the device must be designed to trigger the specific integer overflow in usbaudio.sys during Windows USB enumeration. User interaction (UI:R) is required, likely the standard Windows audio device enumeration process that occurs upon plug-in, though the precise interaction is not further specified in available sources. No prior authentication or privileges on the target system are required (PR:N). No special software configuration or non-default Windows setting is cited as a prerequisite. Exploitation is limited by: physical proximity requirement, the need to craft a malicious USB audio device (hardware or firmware engineering required), and the current absence of public exploit tooling.

The CVSS 3.1 vector AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a score of 6.6, which accurately reflects the mandatory physical access constraint - the most significant limiting factor. An attacker must be co-located with the target machine and physically connect a malicious USB audio device, which rules out remote or automated mass exploitation. EPSS data is not available in the provided sources. The CVE is not in CISA KEV and no public exploit code has been identified, reducing urgency for remote-first defenders. The UI:R component suggests the vulnerability may require Windows to fully enumerate and register the audio device before triggering, which is typically automatic upon plug-in but may involve user-level audio subsystem interactions. Real-world priority is moderate for most enterprise environments: physical security controls mitigate this effectively. High-risk scenarios include shared workstations, kiosk systems, conference room machines, or environments where insider threat or Evil Maid attacks are plausible. The broad affected version range (all supported Windows) makes patching straightforward through standard Patch Tuesday cadence.

An attacker with physical access to an unattended Windows workstation - for example, during an Evil Maid attack on a conference room laptop - connects a crafted USB audio device whose descriptor fields are engineered to trigger the integer overflow in usbaudio.sys. Windows automatically enumerates the device, the driver performs the vulnerable calculation, and the resulting heap overflow corrupts kernel memory, allowing the attacker to execute shellcode at SYSTEM privilege. No public exploit code exists at time of analysis, so reproducing this scenario currently requires original vulnerability research.