Windows USB Hub Driver CVE-2026-72999

Physical access to an exposed USB port on the target system is the sole and mandatory prerequisite; there is no network-based exploitation path. The attacker must plug a specially crafted USB device (emulating a malformed hub) directly into the machine. No authentication, no logged-in user session, and no user interaction are required - the driver processes USB descriptors automatically upon device insertion. The physical access requirement is the primary limiting factor: organizations with locked chassis, USB port blockers, physical security perimeters, or Group Policy-enforced USB device restrictions are significantly protected. All unpatched Windows 10, Windows 11, and Windows Server builds listed in the affected range running the default usbhub.sys driver are vulnerable in their default configuration.

The CVSS 3.1 base score of 6.8 accurately reflects the physical-access requirement (AV:P), which is the dominant risk-limiting factor: an attacker must be within arm's reach of an unlocked or powered USB port. Despite C:H/I:H/A:H impact metrics - consistent with full OS compromise via kernel-level EoP - the physical vector drastically narrows the realistic threat population to insiders, supply-chain actors, and scenarios involving unattended workstations or shared lab/kiosk machines. EPSS data is not provided in the input; KEV status is not confirmed by CISA at the time of this analysis, and no public exploit code has been identified. For most enterprise environments with standard physical security controls, this vulnerability represents a medium operational priority: critical for high-value targets (executives, air-gapped systems, classified workstations) and scenarios where USB ports are accessible to untrusted parties, but low urgency for hardened environments where USB access is already restricted. The breadth of the patch surface (15 distinct Windows build ranges) confirms systemic prevalence of the affected driver code.

An attacker with brief physical access to a target workstation - for example, a malicious insider or a visitor left momentarily unattended - plugs a pre-programmed USB device (a Raspberry Pi or commercial USB attack tool emulating a malformed hub) into an exposed USB port. The Windows USB Hub Driver reads beyond the bounds of a kernel buffer while parsing the device's crafted descriptors, providing a memory disclosure or corruption primitive. The attacker leverages this primitive to escalate from an unprivileged user or unauthenticated hardware context to SYSTEM privileges, achieving full control of the machine. No public exploit code has been identified at time of analysis.