Windows USB Driver EUVD-2026-43880

Exploitation requires local, authenticated access with low privileges already present on the host (CVSS PR:L, AV:L) - this is a post-compromise privilege escalation, not a remote entry point. The attacker must interact with the Windows USB driver and reliably win a timing-sensitive race condition; high attack complexity (AC:H) is the principal limiting factor, as the synchronization window is non-deterministic and typically demands many attempts. No user interaction is needed (UI:N). Practical exploitation is further constrained by needing the ability to invoke USB driver code paths on the target; environments that restrict USB usage or local code execution raise the bar. Only builds below the fixed versions on the listed Windows 10/11 and Server 2012-2025 editions are vulnerable.

Signals are consistent and point to a genuine-but-not-emergency priority. The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0, High) shows local-only access, high attack complexity (winning the race), and a requirement for existing low-level privileges - a meaningful barrier to opportunistic attackers. EPSS is low at 0.19% (9th percentile) and CISA SSVC marks Exploitation: none and Automatable: no, both reinforcing that this is not currently mass-exploited and is hard to reliably weaponize. Countervailing that, SSVC Technical Impact is 'total' and the CVSS impact metrics are C:H/I:H/A:H, meaning a successful exploit fully compromises the host. Note one data conflict: the description states privilege elevation while the intelligence Tags also list 'Information Disclosure' - the primary vendor-classified impact is local EoP, and the disclosure tag should be verified against the MSRC advisory. Net: patch on the normal expedited cycle for a local EoP; it is not a drop-everything internet-facing threat.

A low-privileged user (or malware running in a standard user context after initial foothold) executes a small local program that repeatedly triggers USB driver operations to hit the synchronization window, racing to corrupt kernel state before the driver revalidates it. On a successful race the attacker gains kernel/SYSTEM privileges and can disable security tooling or install persistence. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means many attempts may be needed to win the race.