EUVD-2026-44017
GHSA-mr77-3w6c-769w
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with an existing low-privileged account (AV:L/PR:L), timing-dependent race gives AC:H, no user interaction, and a successful win yields full SYSTEM-level C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows USB Print Driver affecting Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 lets an already-authenticated, low-privileged user win a race condition (CWE-362) in the driver to gain higher privileges. Microsoft has released a patch and reported the flaw itself; there is no public exploit identified at time of analysis. The high attack complexity (AC:H) reflects the timing-dependent nature of exploiting the shared-resource synchronization defect.
Technical ContextAI
The vulnerability lives in the Windows USB print class driver, a kernel-mode/privileged component that manages USB-attached printer devices. The root cause is CWE-362, a race condition arising from concurrent execution using a shared resource with improper synchronization: two or more threads access shared driver state (e.g., device or job structures) without adequate locking, creating a window in which state can be manipulated between a check and a use (a TOCTOU-style flaw). Because the driver runs with SYSTEM/kernel privileges while accepting operations initiated by lower-privileged users interacting with print/USB device handling, successfully corrupting that shared state during the race lets an attacker's low-privileged context influence privileged execution. The CPE data confirms the affected surface is the Microsoft OS itself across Windows 11 Version 24H2, 25H2, 26H1, Windows Server 2025, and Windows Server 2025 Server Core.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-54996 to all affected SKUs (Windows 11 24H2/25H2/26H1 and Windows Server 2025 including Server Core) as the primary and complete fix - the exact KB/build is listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54996. Because exploitation requires an authenticated local account, an interim compensating control on systems that cannot patch immediately is to restrict local logon and interactive access to trusted users only, reducing the population able to run the exploit; note this does not help on shared or multi-tenant hosts. Where USB printing is not needed, disabling or restricting USB device installation for the printer class via Group Policy (Device Installation Restrictions) reduces reachable attack surface, with the trade-off that legitimate USB printer connections will be blocked. These controls only narrow exposure and are not a substitute for the update.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today