Executive brief
A heap-based buffer overflow exists in Windows' USB Mass Storage Class Driver, a core component that enables communication with external USB storage devices like external hard drives and flash drives. An attacker with network access could exploit this vulnerability to execute arbitrary code with system-level privileges, potentially enabling data theft, system compromise, or lateral movement within an organization.
Technical details
This vulnerability is a heap-based buffer overflow in the Windows USB Mass Storage Class Driver (usbstor.sys or related components). The flaw allows an attacker to overwrite heap memory by sending specially crafted network packets that trigger an insufficient bounds check during USB mass storage protocol processing. No authentication is required to trigger the overflow from a network-adjacent or network position. Successful exploitation results in arbitrary code execution in kernel context. Microsoft has released patches addressing this issue; administrators should apply the security update immediately to affected Windows systems.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed