Executive brief
The Windows USB Audio Class driver (usbaudio.sys) handles audio processing for USB audio devices connected to a computer. An authorized attacker with local access could exploit an integer overflow vulnerability to gain elevated privileges and take control of the system.
Technical details
An integer overflow or wraparound vulnerability exists in the Windows USB Audio Class driver (usbaudio.sys). The vulnerability requires an attacker to already have local access and authorization on the target system. By exploiting this integer overflow, an attacker can escalate privileges from a lower-privileged user context to administrator or system-level access. This is a local privilege escalation vulnerability with no network attack vector. A patch is available from Microsoft via the Security Update Guide.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed