CVE-2026-72953: Windows USB Driver Privilege Escalation

CVE-2026-72953 Overview

CVE-2026-72953 is a heap-based buffer overflow [CWE-122] in the Windows USB Driver. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. Microsoft published the advisory on September 8, 2026, and last updated it on September 9, 2026.

The vulnerability requires local access and low privileges. Successful exploitation yields high impact to confidentiality, integrity, and availability. No user interaction is required, and no public exploit is currently known.

Critical Impact
A local attacker with standard user rights can trigger a heap overflow in the Windows USB Driver to gain SYSTEM-level privileges on the affected host.

Affected Products

Microsoft Windows (USB Driver component)
Refer to the Microsoft CVE-2026-72953 Update Guide for the authoritative list of affected builds
Specific product SKUs and build numbers were not enumerated in the NVD record at publication

Discovery Timeline

2026-09-08 - CVE-2026-72953 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72953

Vulnerability Analysis

The flaw resides in the Windows USB Driver, a kernel-mode component that manages USB device enumeration and I/O. A heap-based buffer overflow occurs when the driver writes past the bounds of an allocated pool buffer. Kernel-mode overflows of this class are commonly exploited to corrupt adjacent pool objects and hijack control flow.

The attack vector is local, and the attacker must already hold low-privileged access to the target. Because the vulnerable code executes in kernel context, successful exploitation grants SYSTEM privileges. This provides full control over the operating system, including the ability to disable security tooling, install persistent implants, and access all user data.

The CWE-122 classification indicates the overflow occurs in a heap region, typically the kernel pool for driver code. Exploitation generally involves grooming the pool, triggering the overflow, and overwriting a controllable structure such as a callback pointer or object header.

Root Cause

The root cause is missing or incorrect bounds validation when the USB Driver processes input into a heap-allocated buffer. Microsoft has not published low-level technical details. Refer to the Microsoft CVE-2026-72953 Update Guide for vendor guidance.

Attack Vector

An authenticated local attacker interacts with the USB Driver through IOCTLs, device I/O, or USB device events to reach the vulnerable code path. The attacker supplies crafted input that exceeds the destination buffer size. The resulting kernel pool corruption is then leveraged to escalate to SYSTEM.

No network exposure exists for this vulnerability. Physical USB device presentation may also be a viable trigger in scenarios where the attacker can attach a malicious device.

Detection Methods for CVE-2026-72953

Indicators of Compromise

Unexpected kernel pool corruption events or bugchecks referencing usbhub, usbxhci, usbccgp, or related USB stack drivers
Process token elevation where a standard user process suddenly runs as NT AUTHORITY\SYSTEM without a legitimate elevation event
New services, drivers, or scheduled tasks created shortly after suspicious USB device activity

Detection Strategies

Monitor Windows Error Reporting and kernel crash telemetry for repeated bugchecks in USB driver modules, which can indicate exploitation attempts
Correlate low-privileged process activity with subsequent SYSTEM-level actions such as driver loads, LSASS access, or registry modification under HKLM\SYSTEM\CurrentControlSet\Services
Flag execution of local privilege escalation tooling and unsigned binaries interacting with USB device objects via DeviceIoControl

Monitoring Recommendations

Enable and forward Sysmon Event IDs 1 (process create), 6 (driver load), and 10 (process access) to a central analytics platform for correlation
Track anomalous handle opens to \Device\USB* objects from non-system processes
Alert on kernel-mode integrity violations and Driver Verifier faults on endpoints under active monitoring

How to Mitigate CVE-2026-72953

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72953 Update Guide as soon as testing permits
Prioritize patching on multi-user systems, jump hosts, and endpoints where non-administrative users hold interactive logon rights
Audit local accounts and remove unnecessary interactive logon privileges to shrink the population of potential attackers

Patch Information

Microsoft addresses CVE-2026-72953 through the monthly security update channel. Consult the Microsoft CVE-2026-72953 Update Guide for the specific KB article, affected builds, and replacement package identifiers.

Workarounds

No official vendor workaround is documented in the NVD record; patching is the recommended remediation
Restrict physical access to endpoints to reduce risk from malicious USB device presentation
Enforce application allowlisting and least-privilege policies to limit which local users can execute arbitrary binaries that reach the USB driver

bash

# Verify the Windows USB Driver update is installed (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceClass -eq 'USB' } |
    Select-Object DeviceName, DriverVersion, DriverDate