Windows USB Video Driver: Buffer over-read allows local privilege escalation

Summary

The Windows USB Video Driver contains a buffer over-read (CWE-126) that allows an authorized local user to elevate privileges. An attacker needs an existing local account and must overcome high attack complexity, so this is not a remote risk. Microsoft's CVSS vector scores only confidentiality impact, which should be checked against the Microsoft advisory. Windows 10, Windows 11 and Windows Server 2016 to 2022 builds below the listed versions are affected.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 to below 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 to below 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to below 10.0.20348.5870)

Fixed in

• Per the CVE record, the fixed builds are the versions listed as the upper limit in the affected list above.
• Unverified third-party listings name the November 2026 cumulative updates KB5131096 (21H2), KB5131087 (23H2), KB5132061 (24H2) and KB5131080 (Server 2025). Verify KB numbers on MSRC before rollout.

Workaround

• No Microsoft workaround found. Patching is the available remediation.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• The CVSS temporal vector E:U indicates no public exploit code at publication.
• Public proof of concept: Unknown.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows builds after confirming the exact fixed build on the Microsoft Security Update Guide.
• Prioritise shared PCs, terminal servers and multi-user workstations where staff or contractors have local logon.
• Limit local logons and remove unused USB video devices where practical.
• Re-check the Microsoft advisory and CISA KEV in a few days, as NVD analysis is still pending.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-112990 www.cve.org
• Microsoft Security Update Guide CVE-2026-112990 msrc.microsoft.com
• Senserva KB5131080 (unverified third-party) senserva.com
• Senserva KB5131096 (unverified third-party) senserva.com
• Strix CVE-2026-112990 (unverified third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:55.