Windows USB Driver EUVD-2026-73404

Exploitation requires a low-privileged local user account on the target Windows system (PR:L) - remote unauthenticated exploitation is not possible given the AV:L vector. The attacker must be able to interact with the USB subsystem, which is enabled by default on all affected desktop and server editions. The AC:H rating reflects the inherent timing challenge of winning a kernel race, which typically requires multiple attempts and may be affected by system load, CPU core count, and scheduler behavior. Exploitation is not possible without existing local code execution. Systems with no interactive local logon exposure (e.g., headless servers with strict logon restrictions) substantially reduce practical risk, but the vulnerability is present in default configurations of all listed Windows versions.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a local privilege escalation that requires a low-privileged account (PR:L) and elevated attack complexity (AC:H) due to race-condition timing requirements. Real-world exploitability is constrained: the attacker must already have local interactive or remote shell access, and must reliably win a timing race in the kernel, which often requires multiple attempts and system-specific tuning. EPSS data is not present in the input, and no KEV listing or public POC is identified, suggesting this has not yet seen widespread automated exploitation. That said, privilege escalation primitives in USB drivers are a favored technique for post-exploitation chains - even a mid-sized municipal IT team in bytom should treat this as an urgent patch priority when combined with an initial access vector. The extremely broad affected version footprint (17 distinct Windows SKUs spanning over a decade of releases) significantly expands aggregate exposure. C:H/I:H/A:H impact reflects full system compromise following successful EoP.

An attacker with a low-privileged local account - gained through phishing, credential theft, or exploitation of a separate vulnerability - triggers repeated concurrent USB I/O operations designed to win a kernel race window in the USB driver's shared state. Upon successful race exploitation, the attacker overwrites a security token or function pointer in kernel memory, escalating to SYSTEM privileges. No public proof-of-concept is known at time of analysis, but the technique class (kernel race → token swap) is well-understood by post-exploitation tooling authors.