Executive brief
A security vulnerability exists in the Windows driver responsible for managing USB video devices like webcams. An attacker with physical access to a computer could use a malicious USB device to gain full control over the system. This could lead to the theft of sensitive data or the installation of unauthorized software, though it requires the attacker to be physically present at the machine.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Windows USB Video Driver. The vulnerability is triggered when the driver improperly handles data from a connected USB video device. An attacker with physical access can exploit this by connecting a specially crafted USB device to the target system. Successful exploitation requires some user interaction and allows the attacker to achieve local privilege escalation (LPE), gaining SYSTEM-level permissions. Microsoft has released security updates for various versions of Windows 10, Windows 11, and Windows Server to address this issue.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2
- Microsoft Windows Server 2012 R2, Server Core
Timeline
- 2026-07-14: disclosed: CVE published by Microsoft and NVD
- 2026-07-14: patched: Security updates released by Microsoft