Technical impact
A race condition in the Windows USB Driver allows an authorized local attacker to elevate privileges. The flaw arises from improper synchronization when multiple processes concurrently use a shared resource, enabling a use‑after‑free or similar condition that can be abused to gain higher privileges on the affected machine. The description explicitly states that the vulnerability permits a local attacker to raise privileges, and the specified CWEs (CWE‑362 and CWE‑416) confirm the nature of the weakness. The likely attack vector is local: the attacker must already have some user level or unauthorized access to the system and must trigger the race condition, for example by supplying a specially crafted USB device or sequence of USB traffic.
Affected Systems
The impact spans several Microsoft Windows platforms. Affected are Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2 and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022 and 2025, including their server core and architecture variants. All these operating systems contain the vulnerable USB Driver and therefore require remediation.
Risk and Exploitability
The CVSS score of 7.8 classifies the vulnerability as high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no known mass exploitation yet. The attacker’s requirements are local access and the ability to trigger a race condition, making this a targeted issue rather than a widespread remote attack vector.
