Microsoft Windows USB Hub Driver: Information disclosure via out-of-bounds read

Summary

The Windows USB Hub Driver contains an out-of-bounds read (CWE-125) that affects several Windows 10, Windows 11 and Windows Server versions. An attacker with a local, low-privileged account can read memory contents they should not see, which discloses information with high confidentiality impact. The flaw is not remotely exploitable and requires local access, so it is mainly a risk on shared systems or as a step after an initial compromise.

Affected

• Windows 10 Version 1607, before 10.0.14393.9688
• Windows 10 Version 1809, before 10.0.17763.9487
• Windows 10 Version 21H2, before 10.0.19044.7846
• Windows 10 Version 22H2, before 10.0.19045.7846
• Windows 11 Version 23H2, before 10.0.22631.7711
• Windows 11 Version 24H2, before 10.0.26100.9974 (conflicting data, see recommendation)
• Windows 11 Version 25H2, before 10.0.26200.9974
• Windows 11 Version 26H1, before 10.0.28000.3501
• Windows 11 Version 26H2, before 10.0.26300.9974
• Windows Server 2016 (including Server Core), before 10.0.14393.9688
• Windows Server 2019 (including Server Core), before 10.0.17763.9487
• Windows Server 2022, before 10.0.20348.5870

Fixed in

• Installation of the Microsoft security update from November 2026 (Patch Tuesday) for the affected Windows versions.
• Fixed builds are listed per product in the CVE record above. Sources disagree on the Windows 11 24H2 build (10.0.26100.9974 versus 10.0.26100.33822), so the exact build must be confirmed in the MSRC advisory.

Workaround

• No vendor workaround known.
• Restrict local logon rights to necessary users.
• Restrict physical access to workstations and USB ports.

Exploitation

• Exploited in the wild: no evidence found.
• Public proof-of-concept exploit: none found.
• CISA SSVC: exploitation none, automatable no, technical impact partial.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows systems as part of regular monthly maintenance.
• Prioritise shared workstations, kiosks, and terminal or RDS servers where many users share a host.
• Confirm the exact fixed build per product in the MSRC advisory before deployment, especially for Windows 11 24H2.
• Restrict local logon and physical USB access where possible.
• Monitor for reports of exploitation or public exploit code after 11 November 2026.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96041 msrc.microsoft.com
• CVE.org record CVE-2026-96041 www.cve.org
• Senserva: KB5132043 (Windows 11 24H2 November 2026 update) senserva.com
• Senserva: KB5131090 (Windows Server 2022 update) senserva.com
• Senserva: KB5131087 (monthly update page) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:32.