The vulnerability is a heap‑based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys). It allows an authorized local attacker to manipulate input data from a USB audio device, triggering improper input validation that writes beyond the driver’s heap buffer. If exploited, the attacker can elevate privileges to the SYSTEM level, potentially enabling further lateral movement or compromise. The flaw is a classic example of CWE‑122 and CWE‑20 weaknesses.

Affected systems include Microsoft Windows 10 version 1607, 1809, 21H2, 22H2 and Windows 11 version 23H2, 24H2, 25H2, 26H1. The same vulnerability also exists in all Windows Server releases from 2012 (including Server Core), 2012 R2, 2016, 2019, 2022 and 2025, impacting the usbaudio.sys driver that ships with these operating systems.

The CVSS score of 7.8 indicates high severity for a local privilege escalation. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local authorized user or an attacker with physical access who plugs in a malicious USB audio device. Once the driver processes the crafted audio input, the overflow can be triggered, granting elevated privileges.