The vulnerability is a heap‑based buffer overflow in the Windows USB Driver that allows an authorized attacker with local access to elevate permissions to a higher privilege level. The flaw is categorized as CWE‑122, indicating that improper bounds checking can corrupt the heap and change program execution. Because the attack requires a user to supply a specially crafted USB request, it is an elevation of privilege rather than a denial of service or arbitrary code execution. An attacker who can supply such a request can potentially gain administrative rights on the affected machine. Based on the description, it is inferred that the attacker must have local access to insert a malicious USB device or otherwise supply a crafted USB request.

All current releases of Windows 10, including versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2 through 26H1, and all Windows Server editions from 2012, 2012 R2, 2016, 2019, 2022, to 2025 are affected. The vulnerability arises in the built‑in USB driver that ships with these operating systems.

The CVSS score of 7.8 reflects a high severity risk for local privilege escalation. Objective exploitation probability data is not available, and the vulnerability is not yet cataloged in CISA’s KEV list. The attack does not require remote network access; an attacker must have some level of authorized or physical access to a machine and the ability to insert a malicious USB device or craft a USB request. Because the flaw is a standard heap overflow, a sufficiently skilled attacker can write shellcode that executes with elevated privileges once the overflow occurs. Based on the description, it is inferred that the likely attack vector is a user with local or authorized access inserting a specially crafted USB device.