Windows USB Driver EUVD-2026-99926

Exploitation requires the attacker to already possess authenticated low-privileged local code execution on the target Windows system (CVSS PR:L, AV:L) - it cannot be triggered remotely or over a network. The specific trigger is malformed input processed by the Windows USB Driver, so the vulnerable code path must be reachable, which it is in default installations since USB driver support ships with all affected Windows client and server editions listed in the EUVD data. No user interaction is required (UI:N). The principal limiting factor is the need for a pre-existing local foothold; there is no self-propagation (SSVC Automatable: no) and no confirmed in-the-wild use. Mitigation is straightforward: apply the vendor patch raising builds to the fixed versions (e.g., Windows 11 24H2 to 10.0.26100.9711, Windows Server 2025 to 10.0.26100.33650).

This is a credible but not emergency-priority local privilege-escalation flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable issue requiring low privileges and no user interaction, with total impact to confidentiality, integrity, and availability - consistent with a kernel-mode driver bug that yields SYSTEM. All severity-amplifying signals point the same way as the restraining ones: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (expected for a local EoP that cannot be scripted for mass internet exploitation), while rating Technical Impact as 'total', which matches the C:H/I:H/A:H kernel compromise. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be factored in - but given the local attack vector, a low EPSS would be unsurprising and would not change the picture. The signals are internally consistent (no conflicts), so this should be treated as a standard-priority patch-management item: dangerous as a post-compromise escalation primitive, but not a remote, wormable, or internet-facing threat. The ubiquity of Windows raises aggregate exposure even though per-host risk requires an attacker to already have a foothold.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a malicious local user, or a compromised service account) runs a crafted program that sends malformed input to the vulnerable USB driver, triggering a heap-based buffer overflow in kernel memory. By corrupting kernel heap structures they escalate from a limited account to SYSTEM, gaining full control of the machine. No public exploit code has been identified at time of analysis, and the attack requires prior local access rather than remote reachability.