USB Print Driver CVE-2026-96304

Exploitation requires the attacker to already have authorized local access with low privileges (PR:L) on the target Windows host and the ability to exercise the USB Print Driver code path that frees the vulnerable object. The flaw is a use-after-free, so successful exploitation depends on winning a race/timing window and controlling heap reuse (reflected in AC:H), which limits reliability. There is NO remote vector (AV:L) and NO user interaction from a victim is needed (UI:N). Limiting factors for defenders: an attacker must first obtain code execution or an interactive session on the machine, exploitation is probabilistic rather than deterministic, and only unpatched builds below the fixed versions listed in EUVD (e.g. Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650) are affected.

This is a CWE-416 use-after-free in the Windows USB Print Driver scored 7.0 (High) with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N. The signals point to a moderate, not emergency, priority. AV:L confirms this is a LOCAL privilege-escalation flaw, not remotely reachable - an attacker must already be able to execute code on the host. PR:L means an authenticated/authorized low-privileged user is required, and AC:H indicates exploitation depends on winning a race or satisfying timing/memory-layout conditions, both of which lower reliability. Against that, the impact triad is maximal (C:H/I:H/A:H), consistent with kernel/driver memory corruption yielding SYSTEM-level code execution. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code was supplied, so exploitation status is 'no public exploit identified at time of analysis.' Net: a genuine but second-tier patch item - the AV:L + PR:L + AC:H combination makes it a post-compromise escalation tool rather than an internet-facing or wormable threat, but the SYSTEM-level impact and ubiquitous Windows footprint mean it should be remediated in normal patch cycles and prioritized on multi-user or shared hosts. Note one tag inconsistency: the input carries a 'Denial Of Service' tag, yet the CVSS impact and description describe elevation of privilege (full CIA) - verify the intended impact class with Microsoft's advisory.

A low-privileged but authenticated local user (or malware already running in a standard user context) interacts with the Windows USB Print Driver to trigger a use-after-free, reclaiming the freed object with attacker-controlled data to corrupt kernel memory. Because exploitation requires AV:L (local access) and AC:H (a timing/race condition), it is used for post-compromise escalation from standard user to SYSTEM rather than initial entry. No public exploit code was identified at the time of analysis.