Executive brief
A vulnerability in Windows USB Driver allows an authorized network user to overflow a stack buffer and gain elevated system privileges. This could enable an attacker with network access and valid credentials to take control of the system and execute arbitrary code with administrator-level permissions.
Technical details
A stack-based buffer overflow exists in the Windows USB Driver, exploitable by an authorized attacker over the network. The vulnerability allows an attacker with valid authentication to trigger the overflow condition by sending specially crafted network traffic, bypassing normal access controls to achieve privilege escalation. An attacker who successfully exploits this flaw can execute arbitrary code with system-level privileges. Microsoft has issued a security update to remediate this issue.
Affected products
- Microsoft Windows USB Driver
Timeline
- 2026-09-08: disclosed