CVE-2026-72999: Windows USB Hub Driver Privilege Escalation

CVE-2026-72999 Overview

CVE-2026-72999 is an out-of-bounds read vulnerability [CWE-125] in the Windows USB Hub Driver. An attacker with physical access to a target system can trigger the flaw by connecting a malicious USB device. Successful exploitation allows the attacker to elevate privileges on the affected host.

The vulnerability requires no prior authentication and no user interaction beyond the physical connection. It affects confidentiality, integrity, and availability of the compromised system. Microsoft published the advisory through the Microsoft Security Response Center.

Critical Impact
An attacker with physical access to a USB port can leverage a crafted device to read out-of-bounds kernel memory and escalate to higher privileges on the host.

Affected Products

Microsoft Windows operating systems shipping the USB Hub Driver (usbhub.sys)
Refer to the Microsoft Security Update Guide CVE-2026-72999 for the authoritative list of affected builds
Specific KB numbers and product versions are enumerated in the Microsoft advisory

Discovery Timeline

2026-09-08 - CVE-2026-72999 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-72999

Vulnerability Analysis

The vulnerability resides in the Windows USB Hub Driver, a kernel-mode component that manages USB hub enumeration and device descriptors. The driver reads data structures supplied by attached USB devices during enumeration and configuration. An out-of-bounds read occurs when the driver processes attacker-controlled descriptor fields without adequately validating buffer boundaries.

Because the driver executes in kernel context, memory disclosed beyond an intended buffer can include sensitive kernel data. Attackers can chain that disclosure with additional primitives to defeat kernel address space layout randomization (KASLR) or influence control flow. The end result is elevation of privilege on the target device.

The attack vector is physical, meaning the adversary must connect hardware directly to a USB port. This restricts remote exploitation but remains relevant for shared workstations, kiosks, unattended laptops, and supply-chain scenarios.

Root Cause

The root cause is missing or insufficient bounds checking when the USB Hub Driver parses device-supplied descriptor data. The driver reads past the end of an allocated buffer, exposing adjacent kernel memory. This is a classic [CWE-125] pattern applied to a kernel driver processing untrusted peripheral input.

Attack Vector

Exploitation requires a malicious or programmable USB device such as a Facedancer, Raspberry Pi with USB gadget mode, or a modified thumb drive. The attacker crafts descriptor payloads that reference oversized or malformed length fields. When the operating system enumerates the device, the vulnerable driver reads outside the intended structure and returns memory contents that can seed further kernel exploitation. Technical details are documented in the Microsoft Security Update Guide CVE-2026-72999.

Detection Methods for CVE-2026-72999

Indicators of Compromise

Unexpected USB device insertion events in the Windows System event log, particularly around suspicious hub or composite device identifiers
Kernel warnings, bug checks, or usbhub.sys faults recorded in Event Viewer and Windows Error Reporting
Devices reporting anomalous vendor or product IDs, oversized descriptor lengths, or repeated enumeration failures

Detection Strategies

Correlate USB PnP events (Event IDs 2003, 2004, 2100, 2101, 20001) with subsequent privilege changes or process creation anomalies
Alert on new services, drivers, or scheduled tasks that appear shortly after a USB insertion on assets with sensitive data
Baseline authorized USB device VID/PID pairs and flag deviations, especially on locked-down endpoints

Monitoring Recommendations

Ingest Windows PnP, kernel, and WER telemetry into a central SIEM for cross-host correlation
Enable Windows Defender Device Guard and Attack Surface Reduction telemetry for suspicious driver behavior
Monitor physical access logs alongside endpoint telemetry for kiosks, conference rooms, and shared workstations

How to Mitigate CVE-2026-72999

Immediate Actions Required

Deploy the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-72999 across all Windows endpoints and servers
Prioritize patching for laptops, kiosks, shared workstations, and any device located in low-trust physical environments
Audit which hosts allow USB device installation and restrict enumeration on high-value assets

Patch Information

Microsoft addressed CVE-2026-72999 in the Patch Tuesday release referenced by the MSRC advisory. Administrators should apply the cumulative update that includes the fix for the Windows USB Hub Driver and validate installation with Get-HotFix or the update management console. Refer to the MSRC entry for the KB number that maps to each affected Windows build.

Workarounds

Enforce USB device control through Group Policy Computer Configuration \ Administrative Templates \ System \ Device Installation Restrictions
Disable unused USB ports in BIOS/UEFI on kiosks, servers, and unattended endpoints
Require full-disk encryption (BitLocker) with pre-boot authentication to reduce impact of physical tampering
Apply allowlists for approved USB device classes and block Human Interface Device (HID) impersonation from storage-class devices

bash

# Example: Block installation of all USB devices except those explicitly allowed
# Group Policy path
# Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

# Prevent installation of devices not described by other policy settings: Enabled
# Allow installation of devices that match any of these device IDs: <approved VID/PID list>

# Verify patch installation via PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10