Windows USB Driver: Heap-based buffer overflow leads to local privilege escalation

Summary

A heap-based buffer overflow in the Windows USB Driver allows an authorized local user to elevate privileges. Successful exploitation can lead to full control of the affected system (high impact on confidentiality, integrity and availability). An attacker needs a local, authenticated account and no user interaction, so the flaw is not directly reachable from the internet.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: builds before 10.0.26100.9974 / 10.0.26200.9974 / 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870
• Windows Server 2025: Unknown.

Fixed in

• Fixed in the November 2026 security updates for the builds listed above (per the CVE record ranges). The MSRC advisory is the authoritative source for per-build fixes and must be checked.
• Windows 10 Version 21H2 is listed as fixed by KB5131096 (third-party summary).

Workaround

Unknown. No vendor workaround has been identified.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, technical impact total.
• Not known to be exploited in the wild at the time of research.
• CISA KEV status could not be confirmed.
• No public proof-of-concept found so far.

Our recommendation

• Install the November 2026 Windows security update on all affected Windows 10, Windows 11 and Windows Server systems, starting with older Windows 10 builds such as 1607 and 1809.
• Prioritize shared PCs, terminal servers and multi-user systems, where a local user account is more likely.
• Verify the fixed build numbers in the MSRC advisory.
• Monitor CISA KEV and for public proof-of-concept code, and re-check the exploitation status in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95872 msrc.microsoft.com
• CVE Record CVE-2026-95872 (CVE.org) www.cve.org
• Strix: CVE-2026-95872 www.strix.ai
• KB5131096 summary (Senserva) senserva.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• CISA alert 9 Nov 2026 (KEV additions) www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:08.