Executive brief
Windows USB Video Driver contains a race condition vulnerability in how it manages shared resources during concurrent operations. An authorized local attacker can exploit this flaw to escalate their privileges on an affected Windows system, potentially gaining full administrative control.
Technical details
The vulnerability is a classic race condition (CWE-362) in the Windows USB Video Driver stemming from improper synchronization of shared resources accessed concurrently. An attacker with local system access can exploit a timing window between resource checks and resource use to elevate privileges. The attack requires local access and active attacker involvement, but does not require additional user interaction. A successful exploit grants the attacker elevated privileges on the target system. Microsoft has released patches via its Security Update Guide.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed