Windows UVC Driver EUVD-2026-99518

Requires local, authenticated, low-privileged access to an affected Windows host (AV:L, PR:L) - this is a post-access elevation bug, not remotely reachable. Exploitation targets the Windows USB Video (UVC) driver, so the attacker must be able to reach that driver's processing path, typically by attaching or emulating a crafted USB video device or by issuing malformed input that drives the overflowing size calculation; no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the local-access and valid-account prerequisite; there is no indication a non-default configuration is required, and all listed Windows 10/11 and Windows Server 2016-2025 builds below the fixed versions are affected. Applying the vendor patch removes the exposure.

This is a credible, patch-worthy local privilege escalation but not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local attacker who already holds low-privilege authenticated access and can reliably (AC:L, UI:N) trigger an integer overflow (CWE-190) in the Windows USB Video driver to gain full C/I/A impact - i.e. SYSTEM-level elevation. There is no CISA KEV listing and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so exploitation probability cannot be quantified here; absence of EPSS/KEV/POC is not evidence of safety, merely of missing data. No SSVC decision data was provided. The signals are internally consistent: a local-only EoP reported by the vendor (secure@microsoft.com) with a patch already available, which is the typical profile for Patch-Tuesday-class Windows driver bugs. Real-world priority is moderate-to-high specifically as a post-compromise/second-stage escalation primitive rather than an initial-access or wormable threat, because local access is a hard prerequisite.

An attacker who has already obtained low-privileged local code execution (e.g. via phishing or a standard user account) interacts with the vulnerable Windows USB Video driver - supplying crafted descriptor or buffer-size data that triggers the integer overflow - to corrupt kernel memory and elevate to SYSTEM. No proof-of-concept is publicly identified at time of analysis, and the low attack complexity (AC:L) with no user interaction (UI:N) suggests reliable exploitation is feasible once a working technique is developed.