USB Print Driver EUVD-2026-99772

Exploitation requires the attacker to already have authenticated local access (PR:L) to a Windows system whose USB Print Driver component is present, and to interact with that driver to reach the vulnerable code path; no user interaction by a victim is needed (UI:N). The key limiting factor is high attack complexity (AC:H): the use-after-free depends on winning a race/timing window and reclaiming freed kernel memory, so exploitation is not deterministic and is unlikely to be reliable or automatable (SSVC Automatable: no). It is local-only (AV:L) - not remotely reachable over the network - which further constrains it to attackers who have already gained a foothold. Affected builds are bounded version ranges across Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2022/2025; patched builds listed in the EUVD advisory remove the condition.

This is a genuine but moderate-priority elevation-of-privilege flaw rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) confirms local-only access, already-authenticated attacker (PR:L), and high attack complexity - consistent with the use-after-free (CWE-416) needing a race/timing condition in the USB print driver to be won reliably. All exploitation signals point toward low immediate risk: there is no CISA KEV listing and no public exploit identified at time of analysis, and the CISA SSVC decision framework records Exploitation: none and Automatable: no, which agrees with the high-complexity, local-only profile and argues against mass or wormable abuse. The one elevating factor is SSVC Technical Impact: total, matching the full C:H/I:H/A:H kernel-level impact - successful exploitation yields SYSTEM. In short, the signals are internally consistent (no conflict between CVSS, SSVC, and exploit status): high potential impact but low probability and difficulty of exploitation. Note one tagging inconsistency to verify: the input carries a 'Denial Of Service' tag, yet the CVE is described as privilege elevation with full C/I/A impact - treat it as EoP, with DoS at most a secondary memory-corruption outcome.

A low-privileged user who already has code execution on a Windows host (or a logged-in standard user) triggers the use-after-free in the USB print driver, winning a timing/race window to reclaim freed kernel memory and corrupt a dangling object. No public exploit is known, and the high attack complexity means reliable exploitation requires precise heap grooming and race-condition timing. Success elevates the attacker from a standard account to SYSTEM-level control.