Windows Print Driver CVE-2026-96301

Exploitation requires the attacker to already hold a local, authenticated low-privileged account on the Windows host (AV:L, PR:L) and to interact with the USB Print Driver subsystem to trigger the use-after-free. The dominant limiting factor is the high attack complexity (AC:H): the use-after-free is almost certainly a race condition, so the attacker must reliably win a timing window to reclaim the freed object, making exploitation non-deterministic and, per CISA SSVC, not automatable. There is no network vector and no user-interaction requirement on a victim; the constraint is pre-existing local access plus winning the race. Patched builds per EUVD (e.g. Windows 11 24H2 ≥10.0.26100.9711, Windows Server 2022 ≥10.0.20348.5761, Windows 10 22H2 ≥10.0.19044.7807) are not vulnerable.

This is a genuinely moderate-priority local privilege escalation, not a top-tier emergency. The CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) tells a consistent story: an attacker must already have local, authenticated access with low privileges (PR:L) and must win a race condition or satisfy difficult timing to trigger the use-after-free (AC:H), but success yields total compromise (C:H/I:H/A:H), i.e. kernel-level SYSTEM privileges. The signals largely agree rather than conflict: CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', while still marking Technical Impact as 'total' - this matches AC:H (not automatable/reliable) plus full impact. Exploitation status is 'no public exploit identified at time of analysis' - there is no KEV listing and no POC in the provided data. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this input. Net: the high impact is real, but the local-only vector, required pre-existing authentication, and high attack complexity make this a second-stage/post-compromise escalation tool rather than an internet-facing crisis. Prioritize for patching on multi-user and high-value hosts, but it does not warrant the emergency response a remote unauthenticated RCE would.

An attacker who already has a low-privileged foothold on a Windows host (e.g. a standard user account obtained via phishing or a prior exploit) interacts with the USB Print Driver to trigger a use-after-free, winning the required race condition to corrupt kernel memory and elevate to SYSTEM. No public proof-of-concept exploit is identified in the available data, and the high attack complexity (AC:H) means reliable exploitation requires precise timing rather than a single deterministic trigger.