Windows HID Driver EUVD-2026-100395

Requires local physical access to the target device (CVSS AV:P): the attacker must interact with the machine's USB/HID interface, typically by attaching a malicious or crafted HID peripheral, to drive the Windows HID class driver into the use-after-free. Exploitation is further limited by high attack complexity (AC:H) - a successful attack depends on winning a race against the freeing/reuse of the kernel object, so it is non-deterministic and not reliably repeatable. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is obtained. These constraints mean realistic exposure is confined to shared, kiosk, unattended, or otherwise physically accessible endpoints; remote or network exploitation is not possible.

Signals are mostly consistent and point to a genuine-but-low-urgency issue. The CVSS 3.1 vector (AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.4 Medium) describes a locally-triggered, physical-access use-after-free in the Windows HID class driver yielding full CIA impact (privilege elevation) without prior authentication or user interaction. The physical attack vector (AV:P) plus high attack complexity (AC:H) sharply constrains real-world exploitability: an attacker must be at the machine and win a timing/memory-state race, which is why the base score stays Medium despite C:H/I:H/A:H. There is no EPSS score, no CISA KEV listing, and no indication of public exploit code in the provided data, so there is no public exploit identified at time of analysis and no signal of active exploitation. Note a mild tension: the input Tags include 'Denial Of Service' while the description and the I/A:H impact frame this as privilege elevation (UAF can plausibly do both, but the primary labeled impact is EoP) - treat the DoS tag as secondary. Overall this is a patch-in-normal-cycle item for most fleets, with higher priority only for shared/kiosk/unattended endpoints where physical access is realistic.

An attacker with hands-on physical access to an unlocked or logon-screen Windows device attaches a malicious or specially-crafted USB HID peripheral that drives the HID class driver into a use-after-free condition. By winning the race to reclaim the freed kernel object, the attacker corrupts kernel memory and elevates to SYSTEM. No public exploit code is identified in the available data, and the high attack complexity means reliable exploitation requires precise timing.