Windows USB Mass Storage EUVD-2026-73005

Exploitation requires an authenticated local user session with at least standard (non-admin) privileges - consistent with PR:L in the CVSS vector. The attacker must be able to interact with the USB Mass Storage Class Driver, meaning either physical USB device access or a virtualized/emulated USB storage device in environments like Hyper-V or RDP with device redirection enabled. The attack vector is strictly local (AV:L); remote exploitation over the network is not possible. No special non-default configuration is required - the USB Mass Storage Class Driver is loaded by default on all affected Windows builds when USB storage devices are attached. Limiting factors: requires local interactive access or equivalent session; no network-reachable attack surface; impact is read-only memory disclosure with no integrity or availability consequence.

CVSS 5.5 (Medium) with a local, low-privilege vector accurately reflects the constrained scope of this vulnerability. The attacker must already have an interactive or terminal session on the target machine and the ability to interact with USB storage (physically or via virtualized device pass-through). Integrity and availability are unaffected (I:N/A:N), limiting impact to information disclosure. No EPSS data was provided, and neither KEV listing nor public exploit code has been identified, suggesting this is not under active mass exploitation. Real-world priority is moderate: the information leak could serve as a stepping stone in a multi-stage local privilege escalation chain (e.g., leaking kernel ASLR base addresses), but is not independently catastrophic. The extremely wide version spread - from Server 2012 R2 through current builds - means unpatched legacy Windows systems in enterprise environments represent a persistent exposure surface.

A low-privileged local user on an unpatched Windows endpoint - or an attacker who has compromised a standard user account - connects or emulates a USB mass storage device, then issues crafted I/O control requests to usbstor.sys to trigger the out-of-bounds read. The read operation returns adjacent kernel memory bytes that may reveal kernel virtual addresses, bypassing KASLR and enabling subsequent kernel exploitation. No public exploit code has been identified at time of analysis.