Windows USB Video Driver EUVD-2026-73453

Exploitation requires an authorized (low-privileged) local user account on the target Windows system; PR:L confirms this is not a guest or anonymous attack. A USB Video Class device does not need to be physically attached for the driver to be loaded on many Windows configurations, but the code path must be reachable. The high attack complexity (AC:H) reflects the requirement to win a timing race, which may require multiple attempts and is sensitive to CPU load and scheduling. Exploitation is limited to the local system (S:U, AV:L) and cannot be triggered remotely without a pre-existing foothold. The attack does not require user interaction.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H assigns a base score of 7.0, which accurately reflects the threat model: local access and low privilege are needed, but the high attack complexity (AC:H) acknowledges the timing-dependent nature of race condition exploitation. Real-world risk is moderate-to-high in environments with shared or multi-tenant Windows endpoints (VDI, terminal servers, developer workstations) where low-privileged users are common. This class of LPE is frequently chained with initial-access exploits for full system compromise. No EPSS data was provided, and there is no KEV listing or public PoC at time of analysis, which reduces immediate urgency relative to the CVSS score alone. However, the extremely broad affected version surface - from Server 2012 to the latest Windows 11 releases - means the potential exposure footprint is enormous. The 'Information Disclosure' tag in the source data is inconsistent with the described impact; this appears to be a mislabel.

A low-privileged attacker with local code execution - achieved, for example, through a phishing-delivered initial payload or exploitation of a web-facing service - launches a multi-threaded tool that races the Windows USB Video Driver's shared resource during a concurrent operation such as device open or IOCTL dispatch. By winning the race, the attacker achieves an arbitrary kernel write or hijacks a function pointer, escalating to SYSTEM and enabling full machine takeover. No public PoC exists at time of analysis, but LPE race condition primitives in Windows kernel drivers are a well-understood exploitation class.