CVE-2026-49794: Windows 10 Information Disclosure Bug

CVE-2026-49794 Overview

CVE-2026-49794 is an out-of-bounds read vulnerability in the Windows USB Audio Class driver (usbaudio.sys). The flaw allows an unauthorized attacker with physical access to disclose sensitive information from kernel memory. Microsoft classifies this issue as medium severity, and it affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability is tracked under [CWE-125] (Out-of-bounds Read) and requires a physical attack vector such as connecting a malicious USB audio device to a target system.

Critical Impact
An attacker with physical access to a Windows endpoint can craft a malicious USB audio device to trigger the driver flaw and read information outside the intended buffer boundary, potentially exposing sensitive kernel data.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-49794 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-49794

Vulnerability Analysis

The vulnerability resides in usbaudio.sys, the Windows kernel-mode driver that handles USB Audio Class devices. When the driver processes descriptors or data supplied by an attached USB audio device, it reads memory beyond the bounds of an allocated buffer. This out-of-bounds read exposes adjacent kernel memory contents to the attacker.

Because the driver operates in kernel mode, any leaked data may include kernel pointers, cryptographic material, or fragments of privileged process memory. Information of this nature can support secondary attacks, including bypassing Kernel Address Space Layout Randomization (KASLR) to enable reliable local privilege escalation exploits.

Exploitation requires physical access, which limits opportunistic attacks but remains relevant for scenarios involving unattended endpoints, kiosks, shared workstations, and supply-chain interception. The EPSS score is 0.346%, reflecting limited near-term exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient bounds validation when usbaudio.sys parses attacker-controlled fields from a connected USB audio device. The driver trusts length or offset values within device-supplied structures and reads past the end of the associated buffer, producing an information disclosure primitive classified as [CWE-125].

Attack Vector

An attacker constructs a USB device that advertises itself as a USB Audio Class peripheral and returns malformed descriptors or class-specific data. When the device is plugged into a target Windows system, usbaudio.sys enumerates and parses these structures, triggering the out-of-bounds read. The attacker retrieves the leaked memory through subsequent USB transactions handled by the malicious device.

No verified public proof-of-concept code is available for CVE-2026-49794. See the Microsoft Security Update CVE-2026-49794 advisory for authoritative technical details.

Detection Methods for CVE-2026-49794

Indicators of Compromise

Unexpected USB Audio Class device enumeration events in Windows Event Log sources such as Microsoft-Windows-USB-USBHUB3-Analytic or Microsoft-Windows-Kernel-PnP.
Presence of unknown or unauthorized USB audio peripherals identified by non-standard vendor and product identifiers in device inventory data.
Kernel crashes or unusual driver faults referencing usbaudio.sys correlated with recent USB device insertion.

Detection Strategies

Monitor endpoint telemetry for physical USB device insertions on high-value or unattended systems and correlate against approved hardware inventories.
Alert on newly enumerated USB Audio Class devices in environments where such peripherals are not part of the standard user profile.
Ingest Windows PnP and USB event logs into a centralized data lake to enable historical hunting for anomalous device activity.

Monitoring Recommendations

Enable USB device auditing through Group Policy and forward events to a centralized SIEM for correlation.
Track patch state of usbaudio.sys across the fleet and flag hosts running vulnerable driver versions.
Review physical access logs for restricted areas alongside USB insertion telemetry to identify suspicious activity patterns.

How to Mitigate CVE-2026-49794

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-49794 advisory to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching endpoints exposed to physical access risks, including kiosks, conference room systems, laptops used in public spaces, and shared workstations.
Inventory affected hosts using endpoint management tooling and confirm the updated usbaudio.sys version is deployed.

Patch Information

Microsoft has released security updates addressing CVE-2026-49794 across all supported Windows client and server versions. Refer to the Microsoft Security Update CVE-2026-49794 advisory for the specific KB articles applicable to each Windows build.

Workarounds

Restrict physical access to endpoints where updates cannot be applied immediately.
Enforce USB device control policies through Group Policy or endpoint protection tooling to block unauthorized USB Audio Class devices.
Disable unused USB ports at the firmware level on high-risk systems, such as those in publicly accessible locations.
Educate users to avoid connecting unknown USB peripherals to corporate devices.

bash

# Example: Restrict installation of USB Audio Class devices via Group Policy
# Computer Configuration > Administrative Templates > System > Device Installation >
#   Device Installation Restrictions > Prevent installation of devices that match any of these device IDs
#
# Add the USB Audio Class device setup class GUID:
#   {4d36e96c-e325-11ce-bfc1-08002be10318}
#
# Verify current usbaudio.sys version on a host
Get-Item C:\Windows\System32\drivers\usbaudio.sys | Select-Object VersionInfo