EUVD-2026-99672
GHSA-ff72-wh32-2hm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated local access
-
ExploitInteract with IP Over USB Service
-
ExecutionTrigger out-of-bounds read
-
ImpactDisclose adjacent memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target host has the Windows IP Over USB Service present and running (the service enabling IP connectivity to devices over USB, used by device/SDK tooling rather than a default always-on component), and that the attacker already holds authenticated low-privileged local access (AV:L/PR:L). No user interaction is needed (UI:N). Limiting factors: there is no remote vector, privilege escalation, or code execution - impact is confined to disclosure of memory contents (C:H/I:N/A:N), and hosts without the IP Over USB Service active are not exploitable. |
| Impact | This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information disclosure requiring an already-authenticated low-privileged attacker on the host; it yields high confidentiality impact but no integrity or availability effect. CISA's SSVC decision framework reinforces the low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or available exploit code. The signals are consistent with one another - a local, privilege-dependent memory-disclosure bug with no mass-exploitation vector. Note that no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from this input; absence of KEV/POC is not proof none exists, only that none is recorded here. |
| Exploit ScenarioDerived | An attacker who already has low-privileged local access to a Windows host running the IP Over USB Service triggers an out-of-bounds read (CWE-125) in that service to read memory beyond an intended buffer boundary, disclosing potentially sensitive in-memory data. Because the CVSS vector is AV:L/PR:L/UI:N with no scope change, this requires existing authenticated local foothold and no user interaction, but offers no code execution or privilege gain. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds read in the Windows IP Over USB Service (the component that exposes IP connectivity to devices over USB, typically used by device and SDK tooling rather than being a default always-on service) lets an attacker who already holds low-privileged local credentials read beyond intended memory boundaries and disclose information. According to the assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, this is a local, authenticated, no-user-interaction information disclosure with high confidentiality impact but no integrity or availability impact, and there is no remote vector, privilege escalation, or code execution. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none with the issue not automatable; this is a moderate-severity, low-priority issue rather than an urgent one, and vendor patches are available.
RemediationAI
Vendor-released patches are available: apply the Microsoft updates that bring each affected build to or above the fixed levels - Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, 24H2 to 10.0.26100.9711, 25H2 to 10.0.26200.9711, 26H1 to 10.0.28000.3231, and 26H2 to 10.0.26300.9711, plus Windows Server 2022 to 10.0.20348.5761 and Windows Server 2025 (including Server Core) to 10.0.26100.33650, following the guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70011. There is no widespread exploitation pressure (SSVC exploitation: none, no public exploit identified), so patching can follow normal monthly cycles for most environments, prioritizing hosts that run the IP Over USB Service for device or SDK workflows. As a compensating control on systems where the update cannot be applied promptly, stop and disable the Windows IP Over USB Service (and avoid connecting untrusted USB devices), which removes the vulnerable code path but will break USB-based IP connectivity for device/SDK tooling; additionally, restrict local interactive logon and code execution to trusted users, since exploitation still requires an authenticated low-privileged local foothold and cannot be triggered remotely. Monitor for unexpected local privilege use or process access patterns against the service in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 10 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-125 (Out-of-bounds Read) in the Windows IP Over USB Service, a Windows component that provides IP-based communication to devices attached over USB so that device/SDK tooling can talk to them across a network-style interface instead of raw USB transfers. The root cause class is improper bounds validation on a memory buffer read: the service reads beyond the end (or outside the intended range) of a buffer while processing input, returning adjacent memory contents to the caller. Because privilege requirements are low but not none (PR:L in the assessed vector), the attacker must already be able to execute code locally as a low-privileged user on a host where the service is present and running; the CVSS scope is unchanged (S:U) and the impact is limited to confidentiality (C:H) with no integrity or availability effects. Exploitation cannot be triggered remotely, requires no user interaction (UI:N), and is not considered automatable per CISA SSVC, which limits its practical value as part of a broad attack campaign. From the EUVD data the service ships across the current Windows client and server line, including Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, Windows Server 2022, and Windows Server 2025 (including Server Core).
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authorized local attacker with no user interaction (AV:L/PR:L/UI:N); an out-of-bounds read discloses memory (C:H) without integrity or availability impact and no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB