Microsoft Windows USB Driver: Heap buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows USB Driver allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privilege account or code already running on the affected system, and no user interaction is required. The CVSS 3.1 base score is 7.8 (High).

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Install the Microsoft security update for the respective Windows build. The fixed build is the upper bound of each range listed above.
• KB article numbers: Unknown.

Workaround

Unknown.

Exploitation

• No exploitation in the wild known at the time of writing.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Exploit maturity in the CVE record: Unproven.
• No public proof of concept found.

Our recommendation

• Apply the Microsoft security update for all affected Windows builds in the normal Patch Tuesday cycle, prioritising multi-user systems, terminal servers and servers.
• Replace or upgrade Windows 10 1607, 1809 and 21H2 systems that are out of support, since a patch may not be available for them.
• Apply the principle of least privilege and limit local administrator rights to reduce the impact of local escalation.
• Check the MSRC advisory for the exact KB numbers and any guidance for systems where patching is delayed.
• Monitor NVD and CISA KEV for changes to the status of this vulnerability.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96055 msrc.microsoft.com
• CVE Record CVE-2026-96055 (CVE Program) www.cve.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:44.