Windows USB Audio EUVD-2026-43809

Physical presence at the target machine is the hard prerequisite - the attacker must be able to plug a USB device into an exposed port. The flaw is triggered automatically during USB device enumeration by the kernel (usbaudio.sys), requiring no authentication, no logged-in user, and no special software on the host; it is reachable even at the login screen. Limiting factors are significant: remote exploitation is categorically impossible (AV:P); the attacker must physically control the USB device presented to the driver; impact is confined to information disclosure only (no code execution or availability impact); and the USB audio class driver must be present and not disabled by policy. Environments with locked-down USB ports via Group Policy, physical port blockers, or chassis security controls are not practically exploitable.

All available signals converge on a low real-world threat: CVSS base score 4.6 (Medium) driven entirely by the AV:P (Physical) constraint; EPSS at 0.35% (28th percentile) reflecting negligible observed exploitation probability; SSVC signals exploitation=none, automatable=no, and technical impact=partial. No CISA KEV listing and no public exploit code identified. The C:H confidentiality impact is real - a triggered out-of-bounds read in a kernel driver can expose sensitive in-memory data - but this can only be realized by an attacker with hands-on physical access to the machine. The attack is therefore relevant primarily to evil-maid scenarios, shared public workstations, or physically unsecured endpoints. There is no conflict between data sources; all signals are internally consistent. Priority for most enterprise environments should be low unless physical security posture is a known weakness.

An attacker with brief unattended physical access to a Windows endpoint - such as during an evil-maid hotel-room scenario or at a publicly accessible kiosk - plugs in a USB device advertising itself as a USB Audio Class peripheral with crafted malformed descriptors. Windows automatically loads usbaudio.sys to enumerate the device, triggering the out-of-bounds read in kernel space and disclosing a region of kernel memory to the attacker's device before any user login is required. No public exploit or proof-of-concept code is known at this time.