EUVD-2026-73116
GHSA-8cqc-g9fj-c2vp
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Local vector and high-privilege prerequisite align with kernel driver LPE; scope change reflects kernel boundary escape giving full downstream system impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Heap-based buffer overflow in the Windows USB Video Driver (CWE-122) allows a locally authenticated, high-privileged attacker to escalate privileges with scope change, achieving full confidentiality, integrity, and availability impact across the broader system. Twelve Windows editions are confirmed affected, from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated, high-privileged local account on the target Windows system (PR:H, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.2 reflects genuinely high post-exploitation impact (C:H/I:H/A:H with S:C), but the attack vector is strictly local (AV:L) and requires high prior privileges (PR:H), substantially limiting the exposed population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released cumulative security update from Microsoft's Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72962), which delivers fixed builds for all twelve affected Windows editions as enumerated in the affected products section. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows 10 (build 1809 and later), Windows 11, and Windows Server 2019-2025 systems in your environment and document which have administrative user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today