Windows USB Audio EUVD-2026-73428

The attacker must hold a local authenticated session on the target Windows system with at least standard (low-privilege) user rights - this is confirmed by the PR:L metric. No special hardware, elevated privileges, or non-default configuration is required beyond the presence of the usbaudio.sys driver, which is loaded by default on all supported Windows versions when a USB audio device has been enumerated or the driver is otherwise instantiated. The attack is entirely local (AV:L); remote exploitation is not possible directly via this vulnerability. No user interaction is required (UI:N) beyond the attacker's own actions. Limiting factors: the attacker must first obtain a local session through credentials, physical access, or chaining with another vulnerability.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a local privilege escalation with high CIA impact, low complexity, and no user interaction required beyond obtaining a low-privileged local session. No EPSS data was provided, and this CVE is not listed in CISA KEV, nor is any public proof-of-concept identified at time of analysis - the risk is therefore theoretical-but-credible rather than actively weaponized. The low attack complexity (AC:L) is notable: no race condition, heap spray precision, or unusual configuration is required once local access exists. The scope-unchanged metric (S:U) means the exploit does not directly pivot to other systems, but SYSTEM-level execution on any endpoint enables credential harvesting, persistence, and lateral movement through other means. The breadth of affected versions - spanning 13 years of Windows releases from Server 2012 to Windows 11 26H1 - means the absolute number of vulnerable systems is among the largest possible for any single vulnerability. One data quality concern: CWE-20 (Improper Input Validation) is listed as the weakness class, but the description explicitly identifies a heap-based buffer overflow, which is properly CWE-122; this discrepancy does not alter risk posture but should be noted for taxonomy accuracy.

A low-privileged user with a local Windows session - such as a domain user on a shared workstation or a remote desktop session - triggers the heap overflow in usbaudio.sys by sending malformed input to the USB audio driver, either through interaction with a crafted USB audio device or via user-mode API calls. The corrupted kernel heap object allows the attacker to redirect execution flow within the kernel, escalating from a standard user account to SYSTEM. No public proof-of-concept has been identified at time of analysis, but the AC:L rating indicates the trigger mechanism does not require precise timing or unusual environmental conditions.