Windows USB Driver: Heap-based buffer overflow leads to privilege escalation
Summary
A heap-based buffer overflow in the Windows USB driver allows a local attacker to elevate privileges. The attack requires physical access and a USB device connected to the affected computer, and the attack complexity is high. No authentication is needed, so a visitor, cleaner or insider could try it. A successful attack can result in SYSTEM-level privileges and therefore full control of the computer. Microsoft fixed the issue in its November 2026 Windows security updates.
Affected
- Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9974
- Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9974
- Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3501
- Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9974 (according to a third-party source only, not yet verified on the CVE.org or MSRC pages)
- Windows 10 and Windows Server: Unknown.
Fixed in
- November 2026 Windows security updates, released 10 November 2026, per the Microsoft Security Update Guide.
- Third-party sites name KB5132061 (24H2) and KB5132059 (26H1). These KB numbers are not verified and must be checked in the Microsoft Update Catalog before deployment.
Workaround
- None known. Not needed if the update is applied.
- Generic protection against physical USB attacks: restrict USB device installation via policy or endpoint protection.
Exploitation
- No public proof of concept or exploit found.
- No known in-the-wild exploitation found.
- Microsoft exploit code maturity: Unproven (E:U).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- CISA KEV status: Not verified in the sources.
Our recommendation
- Install the November 2026 Windows security updates on all affected Windows 11 systems and verify the build number after installation.
- Enforce screen locks and full-disk encryption on laptops and workstations.
- Restrict USB device installation via Group Policy or endpoint protection.
- Keep devices out of reach of visitors and secure shared offices and reception areas.
- Check whether Windows 10 or Windows Server systems are affected by confirming the status in the MSRC advisory.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC advisory msrc.microsoft.com
- CVE.org record www.cve.org
- VulDB vuldb.com
- Strix (third-party) www.strix.ai
- Senserva KB mapping 24H2 (third-party) senserva.com
- Senserva KB mapping 26H1 (third-party) senserva.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:52.
Original description (NVD)
Heap-based buffer overflow in Windows USB Driver allows an unauthorized attacker to elevate privileges with a physical attack.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.