Windows USB Driver: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows USB driver allows an authorized local user to elevate privileges. An attacker needs local access and a low-privilege account, so the flaw cannot be exploited remotely. Successful exploitation can give full control over the affected system, with high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)

Fixed in

• Install the Microsoft security update for CVE-2026-96056 that brings the build to or above the fixed version listed for each branch in the affected list.
• KB numbers: Unknown.
• Verify exact fixed builds on the MSRC advisory before rollout.

Workaround

Unknown.

• No vendor workaround identified. Patching is the fix path.

Exploitation

• No public proof of concept found.
• No evidence of in-the-wild exploitation found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• Exploit maturity in the CVE record: unproven.

Our recommendation

• Include the update in the next monthly Windows update cycle and prioritise multi-user systems, terminal servers and RDP servers.
• Verify the Windows build on each endpoint and server against the affected list.
• Check the Microsoft lifecycle status of older Windows 10 branches and plan upgrades where support has ended.
• Limit local admin-like rights and monitor for unexpected privilege escalation to SYSTEM.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record (Microsoft CNA) www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• Strix CVE aggregator (third-party, verify) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:41.