USB Print Driver EUVD-2026-100213

Exploitation requires the attacker to already have an authenticated low-privileged presence on the target Windows system (PR:L, AV:L) and the ability to interact with the Windows USB Print Driver code path. The decisive limiting factor is the high attack complexity (AC:H): the use-after-free (CWE-416) is a race condition that the attacker must reliably win to reclaim the freed object, which is why SSVC marks it Automatable='no'. No user interaction is needed (UI:N) and no special non-default configuration is indicated - the vulnerable print driver ships with the listed Windows builds - but a successful attack is probabilistic rather than deterministic, and systems patched to the fixed builds (e.g. Windows 11 24H2 >=10.0.26100.9711, Server 2025 >=10.0.26100.33650) are not exploitable.

This is a moderate-priority local privilege escalation, not a drop-everything emergency, and the available signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms the flaw is a local, authenticated issue requiring an already-present low-privileged foothold plus a high-complexity trigger (characteristic of a CWE-416 use-after-free race condition), which materially lowers real-world exploitability versus a remote unauthenticated bug of the same 7.0 score. CISA's SSVC framework reinforces a measured posture: Exploitation='none' (no observed exploitation), Automatable='no' (cannot be reliably mass-exploited, consistent with AC:H), but Technical Impact='total' (consistent with C:H/I:H/A:H - full SYSTEM-level compromise if successful). There is no CISA KEV listing and no EPSS score provided, so widespread opportunistic exploitation appears unlikely at this time. The practical takeaway: high impact if exploited (full system takeover) but meaningful barriers to exploitation (local access, valid credentials, and winning a race condition), making this a standard Patch-Tuesday-grade EoP rather than a top-of-queue threat. Note the 'Denial Of Service' tag sits alongside an elevation-of-privilege description; the A:H impact can manifest as a crash, but the primary vendor-stated outcome is privilege elevation, so treat DoS as a secondary effect, not the main risk.

An attacker who already has a low-privileged account or code execution on a Windows host interacts with the USB print driver to trigger a use-after-free, then wins a timing race to reclaim the freed object with attacker-controlled data, corrupting kernel memory to execute code as SYSTEM. No user interaction is required, but the high attack complexity means the exploit may need multiple attempts to succeed. No public exploit identified at time of analysis.