CVE-2026-72962: Windows USB Video Driver Privilege Escalation

CVE-2026-72962 Overview

CVE-2026-72962 is a heap-based buffer overflow [CWE-122] in the Windows USB Video Driver (usbvideo.sys). An authorized local attacker can corrupt kernel heap memory to elevate privileges on the affected system. The flaw carries a CVSS 3.1 score of 8.2 with a scope change, indicating that successful exploitation impacts resources beyond the vulnerable component. Microsoft published the advisory on 2026-09-08 and last updated it on 2026-09-09. No public exploit is currently known, and CISA has not added the issue to the Known Exploited Vulnerabilities catalog.

Critical Impact
Local privilege escalation from a high-privilege context to kernel-level code execution, enabling full system compromise.

Affected Products

Microsoft Windows (USB Video Driver component)
Windows Server releases shipping the affected usbvideo.sys driver
Windows client editions with USB video class support enabled

Discovery Timeline

2026-09-08 - CVE-2026-72962 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72962

Vulnerability Analysis

The vulnerability resides in the Windows USB Video Driver, which handles USB Video Class (UVC) device communication in kernel mode. A heap-based buffer overflow occurs when the driver processes attacker-controlled input without correctly validating buffer boundaries. Writing past the allocated heap region corrupts adjacent kernel structures. An attacker with local access can leverage this corruption to hijack control flow or overwrite security-relevant kernel objects. Because the vulnerable code runs in ring 0, successful exploitation grants SYSTEM-level privileges. The scope-changed CVSS vector reflects that a compromise crosses trust boundaries, moving from a user-mode process to kernel authority.

Root Cause

The root cause is improper bounds checking on data destined for a heap-allocated buffer within usbvideo.sys. When the driver copies data whose length is influenced by the attacker, the size check either is missing or uses an incorrect comparison. This allows writes beyond the allocation to corrupt pool memory. The weakness is classified under [CWE-122] Heap-based Buffer Overflow.

Attack Vector

Exploitation requires local access and high privileges, and no user interaction. An attacker interacts with the USB Video Driver through IOCTLs or a simulated UVC device to trigger the overflow. Successful memory corruption yields kernel code execution and full control of the host. Microsoft has not released public technical details describing the exact triggering path. Refer to the Microsoft CVE-2026-72962 Advisory for vendor-supplied information.

Detection Methods for CVE-2026-72962

Indicators of Compromise

Unexpected kernel pool corruption events or bugchecks referencing usbvideo.sys in Windows crash dumps.
Creation of new SYSTEM-level processes shortly after loading or interacting with USB video devices.
Anomalous IOCTL traffic to the USB video driver from non-media applications.

Detection Strategies

Monitor Windows Error Reporting and minidumps for bugchecks (BAD_POOL_HEADER, KERNEL_MODE_HEAP_CORRUPTION) implicating the USB video stack.
Correlate driver load events (Event ID 6, Microsoft-Windows-Kernel-PnP) with subsequent privilege elevation or LSASS access attempts.
Alert on unsigned or unknown user-mode processes issuing DeviceIoControl calls to \\.\USBVIDEO* device objects.

Monitoring Recommendations

Enable kernel pool tagging and Driver Verifier on high-value hosts to surface heap corruption originating in usbvideo.sys.
Ingest Sysmon Event IDs 1, 10, and 13 to track process creation, handle access, and registry activity around USB video subsystem components.
Track USB device insertion telemetry to identify rogue or emulated UVC devices connected to sensitive endpoints.

How to Mitigate CVE-2026-72962

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72962 Advisory to all affected Windows systems.
Inventory endpoints and servers that expose USB ports and prioritize patching for shared or physically accessible hosts.
Restrict local administrative accounts, since exploitation requires high privileges to reach the vulnerable code path.

Patch Information

Microsoft addressed CVE-2026-72962 through its Update Guide. Administrators should consult the Microsoft CVE-2026-72962 Advisory for the specific KB article, cumulative update, and affected build numbers. Deploy the update through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune according to standard change management procedures.

Workarounds

Disable the USB Video Class driver on systems that do not require webcam or UVC device support using Group Policy device installation restrictions.
Enforce USB port control policies to block untrusted UVC devices from attaching to managed endpoints.
Apply the principle of least privilege to reduce the pool of accounts capable of triggering the vulnerable IOCTL path.

bash

# Configuration example: block USB video class devices via Group Policy device install restriction
# Deny installation of devices matching the USB Video Class (bInterfaceClass=0x0E)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" /v DenyDeviceClasses /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses" /v 1 /t REG_SZ /d "{6994ad04-93ef-11d0-a3cc-00a0c9223196}" /f
gpupdate /force