Windows USB Video Driver CVE-2026-69584

Exploitation requires a local, authenticated low-privileged account on the target Windows system (PR:L in the CVSS vector). The attacker must be able to interact with or trigger processing by the Windows USB Video Driver (usbvideo.sys); this can occur through device enumeration, camera application invocation, or direct IOCTL calls to the driver's device object - a USB camera does not need to be physically attached if the driver is loaded. No user interaction from a second user is required (UI:N). Exploitation is limited to local access only (AV:L) - this is not remotely triggerable over the network. The vulnerability affects a very wide range of Windows versions (see affected products), so version-specific targeting is not a meaningful limiting factor across the Windows estate. Server environments where interactive logon is restricted to administrators represent a meaningful reduction in exposure.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N) accurately captures a local privilege escalation with low attack complexity: any authenticated low-privileged user who can interact with a USB video device or enumerate the driver attack surface can trigger the flaw without requiring any other user's cooperation. EPSS data is not included in the provided intelligence, so exploitation probability cannot be independently quantified; however, the AC:L designation indicates this is not a complex trigger condition. There is no KEV listing and no confirmed public PoC, so current exploitation status is speculative - even a mid-sized municipal IT team in sopot should treat this as urgent given the breadth of affected platforms and the attacker value of a reliable SYSTEM LPE primitive. The unchanged scope (S:U) reflects that impact is contained to the vulnerable system, but 'contained' here means full kernel compromise. The co-presence of 'Buffer Overflow' and 'Integer Overflow' tags suggests the bug class is reliably convertible to memory corruption, which historically lends itself to reliable exploit development.

A low-privileged user logged into a Windows workstation or terminal server session opens an application that enumerates or communicates with the USB video driver - such as a video conferencing client or a device manager utility - triggering the integer overflow in the kernel-mode driver. The overflowed value feeds a pool allocation, resulting in a buffer overrun that overwrites adjacent kernel objects, ultimately allowing the attacker to redirect execution to shellcode running at SYSTEM privilege. No public PoC has been identified at time of analysis, but the AC:L rating suggests the trigger condition is straightforward once the attack surface is understood.