The vulnerability is an untrusted pointer dereference within the Windows USB Hub Driver, classified as CWE‑822. A local attacker can trigger the fault, causing the driver to dereference an untrusted pointer and obtain higher privileges, effectively allowing the attacker to perform actions that require administrative rights. The impact is a local privilege escalation that can compromise the entire system.

Affected Microsoft Windows operating systems include Windows 10 releases from version 1809 through 22H2, and Windows Server builds from 2019 up to 2025, including Server Core installations. Specific versions impacted are Windows 10 Version 1809, 21H2, 22H2 and Windows Server 2019, Windows Server 2019 (Server Core), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core).

The CVSS score of 7.8 categorizes the flaw as high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. Because the issue requires a local attacker with physical or local access—such as one who can connect a USB device or run code on the machine—remote exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported as of this analysis. Following Microsoft’s guidance, the issue can be mitigated by deploying the available security update.