Windows USB Driver: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows USB Driver allows a locally authorized attacker with low privileges to escalate privileges, potentially to SYSTEM level. Successful exploitation would give full control over the affected host (confidentiality, integrity and availability impact rated high). The attack requires local access or a low-privilege foothold and is not reachable directly from the internet. Microsoft reports no public disclosure and no known exploitation.

Affected

• Microsoft Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Microsoft Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Microsoft Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Microsoft Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Microsoft Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Microsoft Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Microsoft Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Microsoft Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Microsoft Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Microsoft Windows Server 2012 incl. Server Core (6.2.9200.0 to before 6.2.9200.26434)
• Microsoft Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to before 6.3.9600.23470)
• Microsoft Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Security update released on 13 October 2026 via the Microsoft Security Update Guide
• Fixed builds: Windows 10 1607 and Server 2016 10.0.14393.9612; Windows 10 1809 10.0.17763.9376; Windows 10 21H2 and 22H2 10.0.19044.7807 / 10.0.19045.7807; Windows 11 23H2 10.0.22631.7652; Windows 11 24H2, 25H2 and 26H2 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711; Windows 11 26H1 10.0.28000.3231; Windows Server 2012 6.2.9200.26434; Windows Server 2012 R2 6.3.9600.23470
• KB numbers: check the MSRC page for the exact update per product

Workaround

Unknown. Microsoft does not document a workaround in the sources reviewed.

• Unofficial suggestion from a third-party aggregator: disable or uninstall the USB driver and restrict USB device use if patching is delayed. This can break peripherals and should be tested first.

Exploitation

• Not publicly disclosed and not exploited according to Microsoft
• Microsoft exploitability assessment: Exploitation Unlikely; exploit maturity unproven
• CISA SSVC: exploitation none, automatable no, technical impact total
• No public proof-of-concept or in-the-wild reports found at time of writing

Our recommendation

• Deploy the October 2026 Windows security updates on all affected systems, prioritizing shared workstations, terminal servers and RDP hosts
• Verify the exact fixed build and KB number for each product on the MSRC page
• Check whether Windows 10 1607 or Windows Server 2012 systems are still within vendor support or Extended Security Updates before relying on this patch
• Restrict local logon and limit user-level malware exposure through standard hardening and least privilege
• Monitor for unusual privilege changes or new SYSTEM processes until patching is complete

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83588 msrc.microsoft.com
• Vulners: CVE-2026-83588 (CNA data) vulners.com
• Strix: CVE-2026-83588 (affected builds, aggregator) www.strix.ai
• OpenCVE: CVE-2026-83588 (third-party workaround suggestion) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:32.