Windows USB Audio EUVD-2026-72963

Exploitation requires a local, authenticated session with at least standard user privileges (PR:L per CVSS). The attacker must be able to interact with the Windows USB Audio Class driver (usbaudio.sys), which loads when a USB audio device is present or simulated - exploitation may therefore require either physical USB device access or the ability to present a virtual USB audio device (e.g., via USB redirect in VDI/RDP sessions with USB passthrough). AC:H reflects a race-condition or precise-timing requirement, meaning exploitation is not reliable without targeted tooling. Limits on exploitation: requires local session (no remote vector), requires low-privilege user account (not anonymous/unauthenticated), and successful exploitation probability per attempt is reduced by high attack complexity. Server Core installations without USB audio device exposure present significantly reduced practical risk.

CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the threat profile: local access and low privileges are required, and AC:H indicates exploitation is not trivial, likely requiring precise timing to win a race condition or craft specific USB device state. Despite the full C:H/I:H/A:H impact (equivalent to SYSTEM compromise), the AC:H gate reduces practical exploitability. No POC is publicly identified at time of analysis, and the vulnerability is absent from CISA KEV, suggesting no confirmed in-the-wild exploitation. EPSS data was not provided. Real-world priority is elevated for endpoints where untrusted users share physical or virtual USB device access (VDI environments, shared workstations, cloud GPU instances with USB passthrough), but lower for hardened server environments without USB audio device exposure. The 'Denial Of Service' tag in the input is misleading - the described impact is privilege escalation; DoS is at best a secondary consequence of a failed exploit triggering a kernel crash (BSOD).

A local user with standard (non-admin) credentials on a Windows workstation or server plugs in or triggers interaction with a USB audio device, then races against the driver's memory management to dereference a freed object in usbaudio.sys. With precise timing - potentially requiring multiple attempts - the attacker corrupts kernel pool memory to redirect execution, achieving SYSTEM privileges. No public POC has been identified, meaning this scenario currently requires meaningful exploit development effort.