Executive brief
The Windows USB Audio Class driver contains a race condition vulnerability that allows a local user with existing system access to escalate their privileges. This could enable an attacker to gain administrative control of an affected Windows system, potentially leading to complete system compromise and unauthorized access to sensitive data or critical business operations.
Technical details
A time-of-check time-of-use (TOCTOU) race condition exists in the Windows USB Audio Class driver (usbaudio.sys) that can be exploited by an authorized local attacker to elevate privileges. The vulnerability arises from a gap between a security check and the actual use of the checked resource, allowing an attacker to manipulate the system state between these two operations. Exploitation requires local system access and the ability to trigger specific driver operations. Successful exploitation results in privilege escalation to a higher privilege level, typically SYSTEM. Microsoft has issued patches to resolve this vulnerability.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed