Windows USB Driver EUVD-2026-73699

Physical access to the target system is the mandatory prerequisite - the attacker must directly connect a USB storage device to an exposed port on the machine. The flaw is triggered during USB device enumeration by the kernel-mode Mass Storage Class Driver, which processes device-supplied descriptor data before any user login occurs, meaning no Windows user credentials are required. A specially crafted USB device that returns malformed descriptor or bulk-transfer response data is necessary to trigger the out-of-bounds read. Exploitation is blocked by: physically locked or epoxy-filled USB ports, Group Policy enforcement of USB Mass Storage denial, Kernel DMA Protection or similar platform firmware restrictions that gate device enumeration, and application of the vendor-released patch. All Windows versions in the listed range are vulnerable unless patched.

Real-world risk is materially constrained by the physical attack vector (AV:P): an attacker must have hands-on access to the target machine to plug in a malicious USB device, which eliminates remote or automated mass exploitation. The CVSS base score of 6.8 appropriately reflects this physical prerequisite. No EPSS data was provided, and KEV status is not listed, indicating no confirmed active exploitation at time of analysis. No public POC has been identified. Despite these mitigating factors, the potential for complete system compromise (C:H/I:H/A:H) means that insider threats, supply-chain hardware implants, or momentary unsupervised physical access - realistic in shared workstation, kiosk, or data-center walk-up scenarios - represent genuine threat paths. The extraordinarily broad version coverage, stretching from end-of-support Server 2012 to current Windows 11 26H1, amplifies aggregate exposure across heterogeneous enterprise environments where legacy systems remain unpatched for extended periods.

An attacker with brief physical access - such as an insider threat, a visitor with momentary unsupervised access, or a supply-chain actor - connects a custom-firmware USB device to an unpatched Windows machine. During USB Mass Storage enumeration, the malicious device returns crafted descriptor or response data that triggers the out-of-bounds read in the kernel-mode driver. The resulting privileged memory access is leveraged to escalate from an unauthenticated physical position to SYSTEM-level privileges. No public proof-of-concept code has been identified at time of analysis.