Windows USB Driver EUVD-2026-99632

Exploitation requires the attacker to already hold authenticated low-privilege local access (CVSS PR:L) to an affected Windows system and to interact directly with the Windows USB Driver component on that host; there is no network-reachable path (AV:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the hard limiting factor is the local, pre-authenticated foothold required - this cannot be reached remotely or by an anonymous attacker. Impact is confined to confidentiality (C:H) via a bounded memory over-read; it does not modify data or affect availability, so it functions as an information-leak primitive (e.g., for ASLR defeat) rather than a direct compromise.

This is a genuinely moderate-risk, not high-priority, issue and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a locally-exploitable information-disclosure flaw requiring low-level privileges and no user interaction, with high confidentiality impact but no integrity or availability impact. CISA's SSVC decision framework reinforces a low operational urgency: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably weaponized at scale), and Technical Impact=partial (consistent with a bounded memory over-read leaking some, not total, information). No EPSS score was supplied in the input, and the vulnerability is NOT in CISA KEV and has no POC identified, so there is no evidence of active exploitation or widespread exploit availability. The local attack vector plus required privileges means an attacker must already have authenticated code-execution footing on the host, which substantially limits real-world risk despite the C:H rating. No signals conflict here; the main gap is the absence of an EPSS probability and of a detailed Microsoft technical writeup beyond the MSRC update-guide link, so exact exploitability nuances cannot be independently confirmed.

An attacker who has already gained low-privileged authenticated access to a Windows host (for example via a standard user account or a foothold from another bug) triggers a crafted interaction with the vulnerable USB driver that reads past an allocated buffer boundary, returning adjacent kernel or driver memory. The leaked bytes could contain sensitive data such as pointers useful for defeating ASLR or fragments of other processes' data, aiding privilege escalation. No public exploit code has been identified at time of analysis, and the local vector plus low-complexity but privilege-dependent path makes this an enabler rather than a standalone compromise.