Windows HID Driver CVE-2026-97804

Exploitation requires the attacker to already have local, authenticated access to the Windows host (PR:L, AV:L) and the ability to send crafted input or IOCTL requests to the HID (Human Interface Device) class driver - a component present by default on all Windows editions, so no non-default feature or special configuration is needed. No user interaction is required (UI:N). The primary limiting factor is that this is purely a local privilege-escalation flaw: it cannot be triggered remotely and offers no value without a pre-existing low-privileged foothold on the target machine.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) is internally consistent with the description: a heap-based buffer overflow (CWE-122) in the Windows HID class driver that lets an already-authenticated local user elevate privileges with low attack complexity and no user interaction. There is no EPSS score, no CISA KEV listing, and no public exploit (POC) in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals do not conflict, they simply all point to 'not currently exploited in public.' The limiting factor keeping this below critical is the AV:L requirement: an attacker must already have local, authenticated code execution, so this is a post-compromise privilege-escalation primitive rather than an initial-access vector. However, the near-ubiquitous Windows footprint and full C/I/A impact mean it is a strong candidate for inclusion in local exploit chains once a patch is reverse-engineered, so routine patch prioritization is warranted. Note no EPSS value was supplied, so widespread-exploitation probability could not be weighed quantitatively.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) interacts with the HID class driver using crafted device input or IOCTL requests to trigger the heap overflow. Successful corruption of kernel heap structures lets them execute code at SYSTEM, achieving full local privilege escalation. No public exploit is known at time of analysis, and because AV:L/AC:L the exploit is low-complexity but requires prior local access.