Windows USB Driver: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows USB driver allows an attacker with local access and a low-privilege account to elevate privileges, potentially to SYSTEM. No user interaction is required, and the impact on confidentiality, integrity and availability is rated high (CVSS 7.8). No exploitation and no public proof of concept are known.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (incl. Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (incl. Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846 (per CNA record)
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846 (per CNA record)
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2 and 26H2: 10.0.26200.0 to before 10.0.26200.9974 and 10.0.26300.0 to before 10.0.26300.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Note: sources differ on some fixed builds; verify on the MSRC advisory.

Fixed in

• Install the current cumulative security update for each affected Windows version and Server edition.
• Fixed builds per the CNA record are listed above; the fixed build for Windows 10 21H2 could not be confirmed.
• Confirm the exact fixed builds on the Microsoft Security Update Guide before rollout.

Workaround

• No vendor workaround is known.
• Whether an interim mitigation is published is unknown.

Exploitation

• CVSS exploit maturity is "Unproven"; no working exploit code is known to the CNA.
• CISA SSVC: exploitation none, not automatable, technical impact total.
• No evidence of in-the-wild exploitation, no CISA KEV entry and no public proof of concept were found. This does not rule them out.

Our recommendation

• Apply the Microsoft security update through the normal monthly cycle, prioritising shared workstations, terminal servers and endpoints with broad user access.
• Remove local administrator rights from standard users to make a foothold harder to exploit.
• Restrict or control untrusted USB devices on sensitive systems.
• Check whether Windows 10 1607 and 1809 still receive updates in your environment, as a fix may not be available for every build.
• Monitor the Microsoft advisory, CISA KEV and vendor advisories for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96005 msrc.microsoft.com
• CVE Record: CVE-2026-96005 (CVE.org) www.cve.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:50.