Windows USB Video Driver EUVD-2026-73116

Exploitation requires an authenticated, high-privileged local account on the target Windows system (PR:H, AV:L). The attacker must be able to interact with the Windows USB Video Driver, which is typically loaded when a USB video capture device or webcam is attached to or present on the system. No user interaction is required once driver access is established. Exploitation is limited by: physical or remote desktop access to the target, the requirement for a pre-existing high-privilege account, and the presence or simulation of a USB video device. Standard workstations and servers without USB video hardware attached would need a simulated or software-exposed driver interface to be exploitable. No special non-default configuration beyond driver presence has been identified as required.

The CVSS base score of 8.2 reflects genuinely high post-exploitation impact (C:H/I:H/A:H with S:C), but the attack vector is strictly local (AV:L) and requires high prior privileges (PR:H), substantially limiting the exposed population. The scope-change metric (S:C) is the most significant risk amplifier: successful exploitation escapes the driver's trust boundary, potentially reaching kernel execution. EPSS data is absent from the provided intelligence, and no CISA KEV listing or public POC code has been identified, suggesting exploitation is not currently widespread. Real-world priority should be driven by exposure: environments where untrusted operators or multi-tenant configurations allow high-privileged local accounts access to USB video hardware face meaningful risk, and even a mid-sized municipal IT team in sopot should treat this as urgent if shared workstations with USB cameras are in scope. The low attack complexity (AC:L) means that if an attacker already holds the required privilege level and local access, weaponization is straightforward once exploitation mechanics are understood.

A malicious insider or compromised high-privileged account on a Windows workstation equipped with a USB video camera sends a specially crafted IOCTL or connects a rogue USB video device with malformed class descriptors; the USB Video Driver processes the input without adequate bounds checking, corrupting kernel heap memory and enabling the attacker to redirect execution flow to arbitrary shellcode running at kernel privilege, achieving full SYSTEM-level control. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) and the availability of vendor-confirmed patch details mean reverse engineering the fix is a realistic path to weaponization for a sophisticated adversary.