USB Print Driver CVE-2026-96310

Requires the attacker to already have local code execution on the host with a valid low-privileged account (AV:L, PR:L) and to interact with the Windows USB Print Driver component. Exploitation is further limited by a high-complexity race condition (AC:H) inherent to the use-after-free, meaning the attacker must reliably win a timing window and reclaim the freed kernel object to achieve escalation; no user interaction is needed (UI:N). It is a post-compromise escalation primitive, not a remote entry point, and affects default Windows installations containing the USB Print Driver on the enumerated vulnerable builds.

This is a moderate-priority local privilege escalation in the Windows USB Print Driver (CWE-416 use-after-free), rated CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vector shows the real limiting factors clearly: AV:L means the attacker must already execute code on the host, PR:L means they need an existing low-privileged account, and AC:H indicates a hard-to-win condition typical of UAF race windows, all of which cap the true risk well below the full-CIA impact (C:H/I:H/A:H, scope unchanged). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. Net: a genuine kernel-level EoP worth patching across Windows fleets, but not an emergency - it is a post-compromise escalation primitive requiring local access, valid credentials, and a successfully-won race, not a trivial remote bug. The 'Denial Of Service' tag partially conflicts with the stated impact (the description describes privilege elevation, not availability loss); the A:H metric makes a crash plausible, but the primary consequence is EoP.

A low-privileged user who already has code execution on a Windows host (e.g., via a standard user account or prior foothold) runs a crafted program that interacts with the USB Print Driver to trigger the use-after-free. By winning a timing race and reclaiming the freed kernel object, the attacker reuses the dangling pointer to corrupt kernel memory and elevate to SYSTEM. No public proof-of-concept was provided in the intelligence, and the high attack complexity (AC:H) means exploitation is not guaranteed on each attempt.