Windows HID Parser EUVD-2026-99423

Exploitation requires the attacker to already hold local, authenticated low-privilege access to the Windows host (PR:L) and the ability to feed a malformed HID descriptor to the HID Parser Library - reachable either from local user context or by presenting a malicious/emulated HID peripheral over USB or Bluetooth. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the local-only attack vector (AV:L) is the primary limiting factor: there is no remote or network-based path. The flaw affects default configurations of all listed supported Windows 10, Windows 11 (through 26H2), and Windows Server 2019-2025 builds below the patched versions, so no special feature toggle is required beyond standard HID processing, which is enabled by default.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms local exploitation requiring pre-existing low-privilege authenticated access, with no user interaction and low attack complexity, yielding total compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with a kernel/driver-level privilege escalation. The signals are mutually consistent and point toward a post-compromise escalation tool rather than an initial-access vector: SSVC rates Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no' (cannot be reliably mass-exploited), while Technical Impact is 'total,' matching the C:H/I:H/A:H impact. There is no CISA KEV listing and no public POC identified, so there is no evidence of active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The risk is therefore real for multi-user, shared, or kiosk Windows systems where an attacker already has a foothold and seeks SYSTEM-level control, but the local-only vector and need for prior access substantially limit opportunistic mass exploitation. The HID Parser Library attack surface (processing of human-interface-device descriptors) is also reachable via malicious USB/Bluetooth peripherals, which should be weighed in physical-access threat models.

An attacker who already has a low-privileged account or code-execution foothold on a Windows host supplies a malformed HID descriptor (e.g., via a crafted or emulated USB/Bluetooth peripheral or a local interface) that triggers a heap-based buffer overflow in the HID Parser Library. By controlling the overflow, the attacker corrupts kernel/driver heap structures to execute code at elevated privilege, escalating to SYSTEM. No public exploit code was identified at time of analysis, and exploitation is not automatable per the SSVC assessment.