USB Print Driver CVE-2026-96253

Exploitation requires local, authenticated access to the Windows host with at least low-level privileges (PR:L) and the ability to interact with the USB Print Driver code path; the driver component must be present and reachable by the attacker's session. The high attack complexity (AC:H) indicates a race or specific memory-state condition must be satisfied to reliably trigger the use-after-free, which materially limits reliable exploitation. There is no network vector (AV:L) and no user interaction requirement (UI:N), so the practical limiting factors are the need for prior local access and winning the race condition - making this a post-foothold escalation rather than a remotely exploitable flaw.

This is a legitimate but moderate-priority local privilege escalation, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the attacker must already have local, authenticated low-privilege access to the host and must win a race or satisfy specific conditions (AC:H) to trigger the use-after-free (CWE-416) in the Windows USB Print Driver - this is why the base score lands at 7.0 (High) rather than Critical despite full C:H/I:H/A:H impact. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit code identified, so there is currently no signal of active or at-scale exploitation. The realistic risk profile is a post-compromise escalation primitive: valuable to an attacker who already has a foothold (malware, a logged-in standard user, or chained with an RCE), but not remotely reachable and not weaponizable without local access. One note on the input metadata: the 'Denial Of Service' tag understates the issue - the CVSS vector reports I:H and A:H alongside C:H, consistent with privilege elevation / memory corruption rather than mere DoS; treat this as an EoP flaw. AC:H (race/condition-dependent exploitation) is the main factor dampening real-world risk.

A low-privileged user or malware already running on a Windows machine interacts with the USB print driver to trigger a use-after-free, winning a timing/state race to reclaim the freed object with attacker-controlled data and execute code at a higher privilege level (SYSTEM). No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) means reliable triggering is non-trivial. This would most likely be used as a local escalation stage after an initial foothold rather than as an initial access vector.