Windows USB Hub Driver: Elevation of privilege via out-of-bounds read

Summary

The Windows USB Hub Driver in several Windows 10, Windows 11 and Windows Server editions contains an out-of-bounds read vulnerability (CWE-125). An attacker with an existing local, low-privileged account can exploit it to elevate privileges and potentially gain full control of the system. The vulnerability is not remotely exploitable and requires no user interaction. Microsoft's CISA SSVC assessment rates exploitation as not automatable, and no public exploit is known.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846, per third-party data)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016 including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019 including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

• Fixed builds are listed in the Microsoft CNA record for the editions above. Verify all build numbers and KB numbers on the MSRC Security Update Guide before deployment.
• Unknown for Windows Server 2025 and other editions not listed in the CNA record.

Workaround

Unknown. No Microsoft-provided mitigation has been identified for this CVE, and patches are available.

Exploitation

• No known exploitation in the wild at publication.
• No public proof-of-concept exploit found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Temporal metrics: exploit code maturity Unproven, remediation level Official Fix.

Our recommendation

• Install the latest Windows security update on all affected systems in the next regular patch cycle, starting with shared workstations, terminal servers and kiosks.
• Check the MSRC Security Update Guide for the exact fixed build and KB number of each Windows version in use.
• Identify legacy systems (Windows 10 1607, 1809, 21H2) and check whether they are still supported and in use.
• Restrict local accounts on shared systems and monitor for unexpected privilege escalation.
• Re-check the CVE entry once NVD analysis is complete, as the CWE and CVSS data may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95999 msrc.microsoft.com
• CVE.org CVE Record: CVE-2026-95999 www.cve.org
• Strix: CVE-2026-95999 (affected versions, third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:52.