Windows USB Driver: Heap-based buffer overflow leads to local privilege escalation

Summary

A heap-based buffer overflow in the Windows USB driver allows an attacker with a valid low-privilege account to elevate privileges to SYSTEM on the local machine. The attack requires local access and low privileges, and no user interaction is needed. Microsoft lists the flaw as affecting multiple Windows 10, Windows 11 and Windows Server builds, with a CVSS 3.1 base score of 7.8.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

Install the Windows security update for the affected build. The fixed builds are listed in the Affected section above (first build without the vulnerability). The associated KB article is not confirmed.

Workaround

Unknown. No vendor-documented workaround is known. Patching is the remedy.

Exploitation

• Microsoft's CVSS vector includes E:U (exploit code maturity 'Unproven'), so no exploit code was known at scoring.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No CISA KEV listing and no public proof of concept were found at the time of research. This is not proof of absence.

Our recommendation

• Inventory all Windows 10, Windows 11 and Windows Server systems and compare their build numbers with the fixed builds above.
• Apply the Windows security update for each affected build in the normal patch cycle; prioritise shared PCs, terminal servers and RDS hosts.
• Verify the KB mapping and fixed builds in the MSRC Security Update Guide before rollout.
• Restrict local logons on shared systems, limit standard users' ability to run unknown programs, and monitor for new KEV listings or public exploits.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-96057 www.cve.org
• Microsoft Security Update Guide CVE-2026-96057 msrc.microsoft.com
• Strix.ai CVE-2026-96057 (secondary) www.strix.ai
• KB5131096 summary (secondary, third-party) senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:42.