Windows USB Audio CVE-2026-69687

Exploitation requires a local user account with at least standard (low) privileges - confirmed by PR:L in the CVSS vector. The attacker must interact with the Windows USB Audio Class driver (usbaudio.sys), most plausibly by connecting a USB audio device or issuing crafted IOCTLs to the driver. No victim interaction is required (UI:N). The attack is strictly local (AV:L) and cannot be triggered remotely over a network. Systems where USB audio functionality is administratively disabled or USB ports are physically restricted have reduced exposure. The driver is loaded by default on Windows installations regardless of whether a USB audio device is present, meaning the attack surface is not limited only to systems with USB audio peripherals actively connected.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a straightforward local privilege escalation: low-privilege account access is the only prerequisite, no interaction is required, and exploitation complexity is low. No EPSS score was provided, so probability cannot be independently quantified. The absence of a CISA KEV listing and lack of reported public PoC code suggest exploitation has not been observed at scale, but the broad affected version range - covering over a decade of Windows releases from Server 2012 to Server 2025 - makes this a high-priority patching target for any Windows estate. The local-only attack vector limits internet-facing risk but elevates insider-threat and post-initial-access scenarios significantly. This is a genuine priority, not a paper-high CVSS issue, because LPE flaws in ubiquitous OS drivers are routinely chained with initial-access exploits.

A standard-privilege user on an unpatched Windows system - or a threat actor who has already obtained initial local access - attaches a specially crafted USB audio device or issues a malformed IOCTL to usbaudio.sys, triggering an integer underflow in buffer-size arithmetic. The resulting memory corruption in kernel pool space is leveraged to overwrite a kernel structure, enabling arbitrary code execution in ring-0 and elevation to SYSTEM. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests a reliable exploit path once the exact vulnerable code path is mapped.