CVE-2026-58528: Windows USB Audio Driver Info Disclosure

CVE-2026-58528 Overview

CVE-2026-58528 is an out-of-bounds read vulnerability [CWE-125] in the Windows USB Audio Class driver (usbaudio.sys). An attacker with physical access to a target system can exploit the flaw to disclose sensitive kernel memory contents. Microsoft classifies the issue as a physical attack vector vulnerability affecting the kernel-mode driver responsible for handling USB audio device communication.

The vulnerability received a CVSS 3.1 base score of 6.8 and is tracked in the Microsoft Security Response Center advisory for usbaudio.sys. Successful exploitation requires the attacker to connect a crafted USB device to the target machine.

Critical Impact
Physical access to a vulnerable Windows system allows an unauthenticated attacker to read out-of-bounds memory through the USB Audio Class driver, potentially exposing sensitive kernel data.

Affected Products

Microsoft Windows systems running the usbaudio.sys USB Audio Class driver
Windows kernel-mode USB audio stack
Refer to the Microsoft Security Update Guide for the complete list of affected Windows versions and builds

Discovery Timeline

2026-07-14 - CVE-2026-58528 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58528

Vulnerability Analysis

The vulnerability resides in usbaudio.sys, the Windows kernel-mode driver that implements the USB Audio Class specification. The driver processes descriptors and control transfers sent by attached USB audio devices. When parsing attacker-controlled device data, the driver reads beyond the bounds of an allocated buffer.

Because usbaudio.sys runs in kernel context, the out-of-bounds read exposes adjacent kernel memory. This memory may contain pointers, cryptographic material, or other sensitive data that assist further exploitation. The CWE-125 classification confirms the read-past-buffer condition as the underlying weakness.

Exploitation requires the attacker to physically attach a malicious USB device that presents crafted audio class descriptors or control requests. No user interaction or authentication is required once the device is connected.

Root Cause

The root cause is missing or insufficient bounds validation when the driver processes USB Audio Class descriptor fields supplied by the device. The driver trusts length or offset values from device-supplied data structures and dereferences beyond the allocated buffer.

USB descriptors are inherently attacker-controlled when the peripheral is malicious. Any parser handling such data must strictly validate every length, index, and offset against the actual buffer size before dereference.

Attack Vector

The attack vector is physical (AV:P). An attacker connects a rogue USB device that impersonates a USB audio class peripheral. The device returns malformed descriptors during enumeration, triggering the out-of-bounds read in usbaudio.sys.

This class of attack is commonly delivered through unattended workstations, kiosks, conference room devices, or lost-and-found charging scenarios where an adversary can briefly connect hardware. Programmable USB tools such as Facedancer-class devices can emulate the crafted descriptors required.

No public proof-of-concept exploit is currently referenced in the CVE record, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-58528

Indicators of Compromise

Unexpected USB audio device enumeration events in Windows Event Log, particularly from unattended systems
Kernel crashes, bug checks, or stability issues involving usbaudio.sys following USB device insertion
Presence of unauthorized or unrecognized USB Audio Class devices in Device Manager or PnP telemetry

Detection Strategies

Monitor Windows PnP and USB enumeration events (Event IDs 20001, 20003, and Microsoft-Windows-USB-USBHUB3 provider events) for anomalous USB Audio Class device connections
Correlate USB device insertion telemetry with kernel driver faults referencing usbaudio.sys
Alert on USB device connections outside business hours or on systems that do not normally use audio peripherals

Monitoring Recommendations

Enable USB device auditing through Group Policy and forward logs to a centralized SIEM for correlation
Track loaded driver versions of usbaudio.sys across the fleet to confirm patch deployment status
Baseline expected USB audio devices per endpoint and alert on deviations, especially on high-value or physically exposed systems

How to Mitigate CVE-2026-58528

Immediate Actions Required

Apply the security update referenced in the Microsoft Security Update Guide for CVE-2026-58528 across all Windows endpoints and servers
Prioritize patching for laptops, kiosks, conference room PCs, and any systems accessible in shared or public spaces
Inventory endpoints running usbaudio.sys and confirm patch installation through configuration management tooling

Patch Information

Microsoft has published a security update addressing the out-of-bounds read in usbaudio.sys. Consult the Microsoft Security Update Guide for the specific KB article, affected Windows builds, and update packages applicable to your environment.

Workarounds

Restrict physical access to endpoints, particularly in shared workspaces, reception areas, and conference rooms
Use Group Policy or Microsoft Intune device control policies to block installation of unauthorized USB audio class devices where operationally feasible
Disable unused USB ports through BIOS/UEFI configuration on systems that do not require peripheral connectivity
Deploy USB port locks or tamper-evident hardware controls on high-risk endpoints

bash

# Example: Block USB Audio Class device installation via Group Policy device setup class GUID
# USB Audio Class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318} (Sound, video and game controllers)
#
# Computer Configuration > Administrative Templates > System > Device Installation >
#   Device Installation Restrictions > Prevent installation of devices using drivers
#   that match these device setup classes
#
# Add class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318}
# Enable: Also apply to matching devices that are already installed