Windows USB Audio EUVD-2026-44065

Exploitation requires physical presence at the target machine to connect a specially crafted USB audio device - CVSS AV:P confirms this as a hard prerequisite. The Windows USB Audio Class driver (usbaudio.sys) loads automatically upon connection of any USB audio-class device on standard Windows installations, requiring no pre-existing configuration change or elevated OS credentials to trigger (PR:N). No user interaction beyond the physical device connection is required (UI:N). Exploitation is strictly limited to information disclosure - kernel memory reads - with no code execution, privilege escalation, or availability impact. Key limiting factors are: (1) the physical access requirement, which rules out all remote, network-based, and opportunistic mass exploitation; (2) the read-only impact, which prevents persistence or lateral movement directly from this vulnerability; and (3) the complete absence of public exploit code or active exploitation per SSVC and EPSS signals.

Real-world risk is low despite broad platform coverage. The CVSS AV:P (Physical) vector is the single most important signal: exploitation requires an attacker to physically connect a crafted USB device to the target machine, which eliminates all remote and network-based threat scenarios. EPSS at 0.37% (29th percentile) reflects the community's expectation of minimal exploitation activity, consistent with the physical access barrier. SSVC independently corroborates this: Exploitation is rated 'none', Automatable is 'no' (physical presence cannot be automated at scale), and Technical Impact is 'partial' (information disclosure only, no code execution or integrity impact). No CISA KEV listing and no public exploit code further reduce urgency. The primary residual concern is in high-security physical environments - government facilities, classified networks, shared workstations, or kiosk deployments - where insider threat or evil-maid attack scenarios are plausible. In standard enterprise environments with physical security controls, this vulnerability presents negligible incremental risk.

An attacker with physical access to an unattended or shared Windows workstation - a conference room PC, a kiosk, or a momentarily unlocked laptop - connects a specially crafted USB device advertising itself as a USB audio device. Windows automatically loads usbaudio.sys to handle the device, and the driver processes malformed USB descriptors or audio control data from the device, triggering an out-of-bounds read that leaks kernel memory contents (such as pointer values or sensitive data resident in adjacent memory) back to the attacker-controlled device. No public exploit or POC is currently known to facilitate this scenario.