Windows Print Driver CVE-2026-96254

Exploitation requires the attacker to already hold valid low-privileged local access to the Windows host (PR:L, AV:L) - this is not remotely exploitable and needs no user interaction (UI:N). The specific trigger is interaction with the Windows USB Print Driver, so a path to exercise USB printing/driver code (local logon, a running process able to reach the driver, or physical/virtual USB device presence) is the concrete prerequisite. The dominant limiting factor is high attack complexity (AC:H): the use-after-free is a race/timing-dependent condition that the attacker does not fully control and must win reliably, which is why CISA SSVC marks it Automatable: no. These constraints confine realistic abuse to post-initial-access privilege escalation rather than opportunistic mass exploitation.

This is a genuinely moderate-priority local privilege escalation rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) tells a consistent, non-sensational story: an attacker must already have local, authenticated access (PR:L) and must win a high-complexity condition (AC:H) - characteristic of the race/timing window typical of CWE-416 use-after-free bugs in kernel-mode USB print drivers - in exchange for total technical impact (C:H/I:H/A:H), which aligns with CISA SSVC's 'Technical Impact: total'. The signals reinforce each other on severity-if-exploited but consistently dampen urgency-of-exploitation: SSVC reports Exploitation 'none' and Automatable 'no' (the AC:H race and local prerequisite make reliable mass exploitation unlikely), there is no CISA KEV listing, and no public exploit has been identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here - however, every other signal (SSVC none/no, no KEV, no POC, AC:H) converges on low near-term real-world risk. One point to verify: the input Tags include 'Denial Of Service', yet the description and CVSS (C:H/I:H/A:H, EoP) describe privilege escalation with full impact, not a DoS-only condition - treat the DoS tag as loosely applied and rely on the EoP framing. Overall: patch on a normal prioritized cadence (it is a privilege-escalation building block often chained after initial access), but it is not a drop-everything network-exploitable flaw.

An attacker who already has low-privileged local access to a Windows host (for example via a phished user account or a compromised service) interacts with the USB print driver to trigger a use-after-free, winning a timing race (AC:H) to corrupt kernel memory and elevate to SYSTEM. No user interaction is required (UI:N), but no public exploit code has been identified at time of analysis, and the high attack complexity makes reliable exploitation non-trivial.