EUVD-2026-99930
GHSA-c7p3-g5q7-xqh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryTrigger crafted USB driver input
-
ExploitOverflow kernel heap buffer
-
ExecutionExecute code as SYSTEM
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have authenticated local access to the target Windows system with at least low-level privileges (PR:L) and the ability to run code or submit input to the USB driver stack; it affects default configurations of the listed Windows 10/11 and Windows Server builds below the patched versions, with no special feature needing to be enabled. Limiting factors: there is no remote vector (AV:L), so an initial foothold on the host is a hard prerequisite, and exploitation is bounded to in-scope (S:U) SYSTEM elevation on the same machine; CISA assesses it as not automatable. No victim user interaction is required (UI:N). |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation flaw in the Windows USB driver requiring an attacker to already hold low-level authenticated access to the host; it is not remotely reachable, which caps the base score at 7.8 (High) despite full C:H/I:H/A:H impact. All exploitation signals point toward low immediate urgency: there is no CISA KEV listing, no public proof-of-concept, and CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', while acknowledging Technical Impact as 'total'. These signals are mutually consistent - a high-impact-but-not-yet-exploited local EoP - rather than conflicting. EPSS is not provided in the input, so probabilistic exploitation likelihood could not be factored in; this is a data gap, not a low score. The realistic concern is as a post-compromise escalation link (pairing an initial foothold with SYSTEM-level control), not as an internet-facing emergency. Patch promptly in normal cycles, but this does not warrant out-of-band response at this time. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (for example via phishing, a malicious local app, or a standard user account) attaches or interacts with a crafted USB device or sends malformed USB request data to trigger the heap overflow in the USB driver. Successful exploitation corrupts kernel heap memory and elevates the process to SYSTEM, giving total control of the machine. No public exploit identified at time of analysis, and no user interaction by a victim is required (UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap-based buffer overflow in the Windows USB Driver stack (CWE-122) allows an attacker who already holds authenticated, low-privileged local access to a target system to elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Microsoft has released a vendor patch, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the flaw as not automatable, making this a genuine but second-tier priority relative to remotely reachable issues. No victim user interaction is required, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
RemediationAI
Vendor-released patch: Microsoft has published a fix for this issue (Patch: Available from vendor; tracked at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83638), delivered through the normal Windows cumulative update channel. Apply the update that brings each system to or above the fixed build level reported in the affected-version data: Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 10 1607 and Windows Server 2016 to 10.0.14393.9612, Windows 10 1809 and Windows Server 2019 to 10.0.17763.9376, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H1 to 10.0.28000.3231, Windows 11 26H2 to 10.0.26300.9711, Windows Server 2012 to 6.2.9200.26434, Windows Server 2012 R2 to 6.3.9600.23470, Windows Server 2022 to 10.0.20348.5761, and Windows Server 2025 to 10.0.26100.33650. Because the attack requires an existing authenticated local foothold (AV:L, PR:L) and is not assessed as automatable, the most effective compensating controls until patching is complete are to reduce local attack surface: enforce least privilege so standard users cannot run arbitrary code on sensitive hosts, restrict interactive logon and RDP/console access to trusted administrators, and monitor for local privilege-escalation behavior such as unexpected SYSTEM token acquisition or anomalously spawned high-integrity processes adjacent to USB device activity. Disabling or removing the USB device class drivers on systems that do not require USB peripherals will eliminate this attack surface but breaks all dependent hardware, so it is only practical as a temporary measure on locked-down server roles; note that no configuration toggle alone mitigates the flaw, so patching remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Windows in-box USB driver stack, which runs in kernel mode and processes descriptors, IOCTLs, and other data supplied by USB devices and by local callers. The root cause is a heap-based buffer overflow (CWE-122): a heap allocation sized for expected input is written past its boundary when a length or count field is not validated, corrupting adjacent kernel pool memory. Because the overflow occurs in kernel context with Scope:Unchanged (S:U), successful corruption can be leveraged for controlled memory writes and ultimately token or privilege manipulation on the same machine, yielding confidentiality, integrity, and availability impact rated High across all three metrics. The CVSS vector shows AV:L with PR:L and UI:N, meaning the attacker must already be able to execute code locally with at least low privileges and send crafted input into the USB driver stack, but needs no help from a user and no additional feature enabled; there is no remote or network attack path. This aligns with the CISA SSVC decision of Exploitation: none, Automatable: no, Technical Impact: total, and with EUVD record EUVD-2026-99930, which tracks the flaw across the Windows 10, Windows 11, and Windows Server servicing branches listed in its affected-version ranges.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel driver EoP needing an existing low-privileged foothold (AV:L, PR:L), no user interaction, yielding full SYSTEM compromise (C/I/A:H) within the same scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A heap-based buffer overflow in the Windows USB Driver stack affects unpatched Windows 10, Windows 11, and Windows Server systems, allowing an authenticated local attacker to elevate privileges to SYSTEM. While no public exploit identified at time of analysis and CISA SSVC rates exploitation as none, the broad deployment of these operating systems means that any initial local access could lead to full endpoint compromise. Leadership should prioritize patching as part of routine update cycles to maintain defense-in-depth and prevent privilege escalation that could facilitate lateral movement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB