Windows USB Driver CVE-2026-72953

Exploitation requires an existing authenticated local session with at least standard user (low-privilege) access on the target Windows machine - consistent with CVSS PR:L. No user interaction beyond initiating the exploit is needed (UI:N), and no complex race condition or special system configuration is required (AC:L). The vulnerability is in the USB driver stack, which is loaded by default on all Windows installations; no non-default configuration or external USB device attachment appears to be necessary based on available data, though the exact trigger path (device enumeration vs. programmatic IOCTL) is not independently confirmed from public sources. Exploitation is constrained to local access only (AV:L): remote unauthenticated exploitation is not possible without a separate initial access vector.

CVSS 7.8 (High) is well-calibrated for a local privilege escalation: AV:L limits the attack surface to hosts where the adversary already has a foothold, but AC:L and PR:L mean any standard user account on a vulnerable Windows machine is sufficient - no elevated privileges or complex setup required. No EPSS score was provided in the input, and the flaw is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. The absence of a public POC further reduces near-term opportunistic risk. However, this class of vulnerability (kernel heap overflow, low-complexity LPE) is highly valued in post-exploitation toolchains and ransomware privilege escalation stages. Defenders should treat this as high-priority for workstations and servers with shared or untrusted user populations. The breadth of affected versions - spanning Server 2022 through the latest Windows 11 26H1 - amplifies the remediation surface.

An attacker who has compromised a low-privileged domain user account on a Windows endpoint - for example, via phishing - executes a locally crafted program that sends a malformed request to the Windows USB driver stack. The malformed input triggers the heap-based buffer overflow in kernel space, corrupting adjacent memory structures and allowing the attacker to redirect execution and obtain SYSTEM privileges. From there, the attacker can disable endpoint security tools, dump credential stores, or move laterally. No public exploit code has been identified at time of analysis.