Windows MTP Driver EUVD-2026-100359

Exploitation requires local physical access to the target Windows system and the ability to connect a Portable Device / MTP (Media Transfer Protocol) peripheral - such as a smartphone, camera, or crafted USB gadget - that feeds malformed MTP data to the vulnerable driver. No prior authentication or software privileges are needed (PR:N) and no user interaction is required (UI:N), but the hard limiting factor is AV:P: the attack cannot be performed remotely or over a network, confining realistic risk to attended endpoints, kiosks, shared/public machines, and lost or stolen devices (evil-maid style access). The affected component is the Windows Portable Device MTP Driver across Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below the fixed versions listed in EUVD-2026-100359.

This is a moderate-priority issue that should not be treated as an emergency despite its HIGH confidentiality/integrity/availability impacts. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) makes clear the gating factor is the PHYSICAL attack vector (AV:P): an attacker must have hands-on access to the target device to exploit the Windows Portable Device MTP (Media Transfer Protocol) driver, which is why a flaw with full C:H/I:H/A:H impact still scores only Medium. There is a notable tension between signals: the description frames this as privilege elevation ('elevate privileges'), which normally implies the attacker already has some foothold, yet the CVSS vector states PR:N (no privileges required) - the reconciliation is that no software privileges are needed because the entry barrier is instead physical presence plus the ability to attach a device. No EPSS score was provided, this CVE is NOT on CISA KEV, and no public exploit was identified in the supplied data, so exploitation probability signals are absent rather than reassuring. Overall: real but situational risk, most relevant to attended endpoints, kiosks, lost/stolen laptops, and evil-maid scenarios rather than remote mass exploitation. Patch during normal cycles, prioritizing physically exposed or high-value devices.

An attacker with brief physical access to an unlocked or locked Windows machine connects a specially crafted USB portable/MTP device (e.g., a rogue phone or storage gadget) that supplies malformed MTP data. The Windows Portable Device MTP driver mishandles this input, triggering a heap-based buffer overflow (CWE-122) that corrupts kernel/driver memory and lets the attacker elevate privileges on the host. No public exploit code was identified at time of analysis, and the attack is constrained to in-person access.