Microsoft Windows USB Video Driver: Heap overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows USB Video Driver allows an attacker with low privileges to elevate privileges to a higher level on the local system. The driver is the in-box driver for USB video devices such as webcams. An attacker needs an existing local foothold, such as a standard user account after phishing or malware, and no user interaction is required.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Fixed in the security update for each affected product from the builds listed above, per the CVE record (Microsoft CNA).
• Exact KB numbers per product: Unknown. Check the MSRC Security Update Guide.

Workaround

• Unknown. Microsoft has not published a workaround for this CVE in the sources reviewed.
• Limiting the installation of USB video class devices with Group Policy or device installation restrictions may reduce exposure. This is not confirmed by Microsoft for this CVE.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public exploit code known at the time of rating (CVSS exploit code maturity: Unproven).
• No evidence of exploitation in the wild found. CISA KEV status not checked.

Our recommendation

• Install the Windows security update from April 2026 or later on all affected systems, prioritising shared PCs, kiosk and meeting-room computers with USB cameras, and endpoints where users have no admin rights.
• Check whether the affected Windows builds, especially Windows 10 1607 and 1809, are still supported on your devices.
• Verify the exact KB per product on the MSRC page before rollout.
• Test USB peripherals (including USB audio devices) after patching.
• Enforce least privilege for standard users to reduce the impact of local escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-95965 msrc.microsoft.com
• CVE Record CVE-2026-95965 www.cve.org
• Strix AI: CVE-2026-95965 (third-party, unverified) www.strix.ai
• SentinelOne: CVE-2026-69584 (related USB video driver CVE) www.sentinelone.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:54.