USB Video Driver EUVD-2026-73495

Exploitation requires a local Windows account with at least standard user (low) privileges on an affected Windows 11 or Windows Server 2025 build; no network access is needed. The Windows USB Video Driver must be loaded, which typically occurs when a USB video capture device is physically attached or the driver is otherwise instantiated. AC:H reflects that reliable exploitation demands careful kernel heap layout control or timing of a race condition in the driver's object lifecycle - this is not a trivially scriptable attack and requires significant exploit development capability. Exploitation is constrained to Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025; prior Windows versions are not listed as affected. No user interaction is required beyond the attacker's own actions on the local system.

The CVSS 3.1 score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a local privilege escalation requiring low privileges and high attack complexity - characteristic of kernel UAF exploitation, which demands precise heap shaping or race-condition timing. The AC:H metric is the primary risk dampener, making mass or automated exploitation unlikely in the near term. No public exploit has been identified and the CVE is absent from CISA KEV, consistent with this being a patched but not yet weaponized vulnerability. That said, the post-exploitation impact is severe: ring-0 execution enables disabling endpoint detection, installing persistent rootkits, and reading all system memory - even a mid-sized municipal IT team in radom should treat this as urgent patching work given that a single compromised local user account is the only prerequisite. EPSS data was not provided in the available intelligence, so probability of near-term exploitation cannot be quantified beyond the qualitative signals above.

A local user on an unpatched Windows 11 or Server 2025 system attaches a USB video capture device or triggers driver interaction through a crafted I/O request, inducing the USB Video Driver to free a kernel object that a racing code path still holds a pointer to. The attacker then sprays the kernel heap to place attacker-controlled data at the freed address and dereferences the dangling pointer, redirecting kernel execution to shellcode that overwrites the process token and elevates the attacker's process to SYSTEM. No public proof-of-concept has been identified at time of analysis; the AC:H rating indicates reliable exploitation requires significant kernel heap-manipulation expertise.