Windows USB Video Driver EUVD-2026-99478

Exploitation requires the attacker to already hold a low-privileged authenticated local account on the target host (PR:L) with the ability to run code that reaches the Windows USB Video Driver's affected code path; no user interaction (UI:N) and no network access are involved. The principal limiting factor is the local-only attack vector - there is no remote trigger - which confines risk to multi-user systems, shared/terminal hosts, or post-initial-access scenarios; a user who cannot execute code locally cannot exploit this. All listed Windows 10, 11 (21H2 through 26H2), and Windows Server 2012 through 2025 builds below the fixed versions are affected, so patching to the fixed build (e.g., Windows 11 24H2 ≥10.0.26100.9711) removes the condition.

This is a credible but moderate-priority local privilege-escalation issue rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity attack by an already-authenticated low-privileged user that yields full confidentiality, integrity and availability impact (SYSTEM-level compromise) on the affected host. CISA's SSVC framework corroborates this profile: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with AV:L requiring pre-existing local access, so it cannot be sprayed at scale), yet Technical Impact is 'total' (matching the C:H/I:H/A:H full-system compromise). All signals are mutually consistent - there is no network vector despite the high impact, and no evidence of in-the-wild use. Note what is MISSING: no EPSS score was provided, so exploitation probability cannot be quantified; the CVE is not in CISA KEV; and no POC was supplied. The combination (local-only vector, non-automatable, no exploitation evidence) means this is a real but second-tier patch priority - important for multi-user hosts, terminal servers, and environments where untrusted users have interactive access, but not an internet-facing drive-by risk.

An attacker who already has a low-privileged local account (or has achieved initial code execution as a standard user) runs a crafted program that interacts with the Windows USB Video Driver, sending malformed data that overflows a heap buffer to corrupt kernel memory and execute code as SYSTEM. Because the CVSS vector is AV:L/PR:L/UI:N, no network access or user interaction is needed, but the attacker must first have local authenticated access. No public exploit code was identified at time of analysis.