Microsoft Windows USB Driver: Elevation of privilege via out-of-bounds read

Summary

An out-of-bounds read in the Windows USB Driver allows an authorized local user to elevate privileges on the affected system. The attacker needs an existing local account and must meet high attack complexity conditions, so this is a privilege-escalation step rather than a remote entry point. The CVSS score is 7.0 (HIGH); the impact on confidentiality, integrity and availability is rated high.

Affected

• Windows 10 Version 1607, 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2016, 2019, 2022 (including Server Core installations)
• Windows Server 2025 and Windows 11 22H2 are not listed in the CNA record; the secondary source lists Windows Server 2025 as affected, which is unverified.
• Exact affected builds are listed on the MSRC advisory.

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9688
• Windows 10 1809 / Server 2019: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2: 10.0.26100.9974
• Windows 11 25H2 and 26H2: 10.0.26200.9974 and 10.0.26300.9974 (per CNA record)
• Windows 11 26H1: 10.0.28000.3501
• Windows Server 2022: 10.0.20348.5870 (secondary source, unverified)
• Corresponding KB numbers: Unknown. Verify on MSRC.

Workaround

Unknown. Where the update is applied, no workaround is needed. Restricting USB device installation via Group Policy or Intune is a general hardening measure, not a vendor workaround.

Exploitation

• Exploited in the wild: no evidence found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Public proof of concept: none found.
• CISA KEV: not listed according to a third-party summary; verify directly.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows systems, prioritising shared workstations, terminal servers and hosts where users can connect untrusted USB devices.
• Confirm the KB number per edition on the MSRC page or in the Microsoft Update Catalog.
• Check the support status of Windows 10 1607/1809 and Server 2016/2019 hosts.
• Restrict USB device installation via Group Policy or Intune and enforce least privilege on user accounts.
• Verify that the patch is not a duplicate of related USB driver CVEs such as CVE-2026-69295.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-96051 www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• Strix CVE-2026-96051 www.strix.ai
• KB5131090 summary (third party) senserva.com
• CVE-2026-69295 (related wording, third party) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:44.