Windows IP Over USB CVE-2026-70008

Exploitation requires the IP Over USB Service (IpOverUsbSvc, shipped with Windows developer/SDK tooling rather than enabled on default Windows installs) to be present and running on the target, plus existing local, authenticated access at low privilege (PR:L) to interact with it. Limiting factors that reduce real-world risk: the attacker must already have code execution or an interactive session on the machine (no remote reach, AV:L), the vulnerable service must actually be installed and active (narrowing the fleet to developer/debugging hosts), and the affected build must be unpatched per the EUVD version ranges. No user interaction is required (UI:N).

This is a credible operational priority as a local privilege-escalation primitive, but not a remote emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes an integer overflow (CWE-190) in the Windows IP Over USB Service that is reachable only locally by an already-authenticated low-privileged user, with no user interaction, yielding full confidentiality, integrity and availability impact within the same scope - consistent with a classic local SYSTEM escalation. Signals that would raise urgency are absent or unknown: no CISA KEV listing is present in the input, no POC is referenced, and no EPSS score was provided, so exploitation probability cannot be quantified from this data. No SSVC decision data was supplied. The reporter is Microsoft itself (secure@microsoft.com) and a vendor patch is available, which is typical of coordinated internal discovery rather than observed in-the-wild abuse. Net: treat as a standard Patch-Tuesday-class EoP - important to remediate on hosts where the service is present, but the local-only attack vector and lack of exploitation evidence argue against treating it as a drop-everything issue. EPSS/KEV/POC are all MISSING from the input and should not be assumed.

A low-privileged user (or malware already running in that user's context) on a Windows host that has the IP Over USB Service installed and running sends crafted input that triggers an integer overflow in the service, corrupting memory in a higher-privileged process. By controlling the resulting allocation/write, the attacker escalates from standard-user to SYSTEM-level code execution. No public exploit code is identified in the provided data, and exploitation requires prior local access.