CVE-2026-85935: Windows USB Driver Information Disclosure

CVE-2026-85935 Overview

CVE-2026-85935 is a buffer over-read vulnerability in the Windows USB Driver that enables an authorized local attacker to disclose sensitive information. The flaw is categorized under [CWE-126] (Buffer Over-read) and affects kernel-mode driver memory handling routines. Microsoft disclosed the issue through its Security Update Guide, and it carries a medium severity rating with local attack vector requirements. Exploitation requires low-privilege local access without user interaction, limiting its reach but preserving its utility for post-compromise reconnaissance and credential harvesting workflows.

Critical Impact
An authenticated local attacker can read adjacent kernel memory contents, potentially exposing sensitive data such as pointers, cryptographic material, or privileged information useful for further exploitation chains.

Affected Products

Microsoft Windows (USB Driver component)
Specific affected Windows versions enumerated in the Microsoft Security Update Guide
Systems with the vulnerable USB Driver loaded in kernel mode

Discovery Timeline

2026-10-13 - CVE-2026-85935 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85935

Vulnerability Analysis

The vulnerability resides in the Windows USB Driver's handling of buffered input or descriptor data. A buffer over-read [CWE-126] occurs when the driver reads past the intended end of a buffer, exposing adjacent memory contents to the caller. In kernel-mode drivers, these memory regions can contain pool allocations, pointers, or residual data from prior operations.

An authorized local attacker with the ability to interact with the USB driver interface can trigger the over-read and retrieve disclosed bytes. The disclosed information can accelerate kernel address space layout randomization (KASLR) bypass or expose sensitive system state.

The vulnerability does not permit modification of memory or denial of service, limiting its direct impact to confidentiality. However, information disclosure primitives in kernel drivers are frequently chained with memory corruption bugs to achieve privilege escalation.

Root Cause

The root cause is improper validation of a length or offset field used to determine how many bytes the driver reads from a buffer. When the length exceeds the actual allocated size, the driver returns data from outside the intended boundary. Specific vulnerable function names are not published in the NVD entry.

Attack Vector

Exploitation requires local, authenticated access with low privileges. The attacker interacts with the USB driver through standard device I/O control (IOCTL) calls or related user-mode interfaces. No user interaction or elevated privileges are required beyond the ability to open a handle to the device.

For technical specifics on the vulnerable code path, consult the Microsoft Security Update Guide.

Detection Methods for CVE-2026-85935

Indicators of Compromise

Unexpected process handles opened against USB driver device objects by non-administrative users
Repeated or malformed IOCTL requests to USB driver interfaces from unusual processes
Local processes performing large or anomalous read operations against kernel device objects

Detection Strategies

Monitor kernel driver interactions and audit IOCTL calls targeting USB driver interfaces for anomalous patterns
Baseline normal USB device access behavior per endpoint and alert on deviations originating from non-privileged processes
Correlate local information disclosure attempts with subsequent privilege escalation or lateral movement activity

Monitoring Recommendations

Enable Windows kernel auditing for device object access and review Event Tracing for Windows (ETW) USB provider logs
Collect endpoint telemetry on process-to-device handle relationships and ingest into centralized analytics
Track patch deployment status across the Windows fleet to identify unmitigated hosts

How to Mitigate CVE-2026-85935

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Windows build
Prioritize patching of multi-user systems, shared workstations, and jump hosts where local attacker presence is more likely
Audit local account provisioning and remove unnecessary interactive logon rights on sensitive hosts

Patch Information

Microsoft addresses CVE-2026-85935 through its monthly security update process. Refer to the Microsoft Security Update Guide for the exact KB article, build numbers, and supported Windows versions. Apply the update through Windows Update, Windows Server Update Services (WSUS), or your enterprise patch management platform.

Workarounds

No official vendor workaround is published; patching is the authoritative remediation path
Restrict local interactive and remote desktop logon rights to trusted administrators on high-value systems
Enforce application control policies to limit which processes can issue IOCTL calls to kernel device objects

bash

# Verify patch status on Windows endpoints
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending