{"id":"CVE-2026-119829","kind":"vulnerability","aliases":["CVE-2026-119829"],"related":[],"title":"Windows USB audio driver: heap overflow lets a physical attacker gain privileges","description":"Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack.","summary":"A heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) can be triggered by an attacker with physical access to the machine. Successful exploitation lets that attacker elevate their privileges.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","usb-audio","windows"],"not_affected_if":["no-physical-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:58+00:00","first_seen_at":"2026-11-10T19:24:58+00:00","triaged_at":"2026-11-10T19:55:42+00:00","updated_at":"2026-11-10T19:55:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:55:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows USB audio driver: heap overflow lets a physical attacker gain privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) can be triggered by an attacker with physical access to the machine. Successful exploitation lets that attacker elevate their privileges.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["windows","usb-audio"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker with physical access gains elevated privileges on Windows","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected Windows builds, the patched versions and whether a user interaction is needed.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-physical-access"],"who_is_affected":"Windows machines with the USB Audio Class driver loaded; exposure requires someone with physical access to plug in a USB device. The sources do not name affected Windows builds or a patch. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4522,"output_tokens":439,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119829':15A,18A '-2026':14A,17A 'access':46B 'allow':70C 'attack':10A,43B,54B,73C,80C 'audio':3A,22B,34B,66C 'base':27B,60C 'buffer':28B,61C 'class':35B,67C 'cve':13A,16A 'driver':4A,36B,68C 'elev':55B,75C 'exploit':51B 'gain':11A 'heap':5A,26B,59C 'heap-bas':25B,58C 'infrastructur':19B 'let':7A,52B 'machin':49B 'overflow':6A,29B,62C 'physic':9A,45B,79C 'privileg':12A,57B,76C 'success':50B 'trigger':40B 'unauthor':72C 'usb':2A,21B,33B,65C 'usb-audio':20B 'usbaudio.sys':37B,69C 'window':1A,23B,32B,64C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the USB Audio Class driver loaded; exposure requires someone with physical access to plug in a USB device. The sources do not name affected Windows builds or a patch. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","usbaudio","windows"],"campaign_type":null,"search_a":"'-119829':15A,18A '-2026':14A,17A 'attack':10A 'audio':3A 'cve':13A,16A 'driver':4A 'gain':11A 'heap':5A 'let':7A 'overflow':6A 'physic':9A 'privileg':12A 'usb':2A 'window':1A","search_b":"'access':46B 'attack':43B,54B 'audio':22B,34B 'base':27B 'buffer':28B 'class':35B 'driver':36B 'elev':55B 'exploit':51B 'heap':26B 'heap-bas':25B 'infrastructur':19B 'let':52B 'machin':49B 'overflow':29B 'physic':45B 'privileg':57B 'success':50B 'trigger':40B 'usb':21B,33B 'usb-audio':20B 'usbaudio.sys':37B 'window':23B,32B","search_c":"'allow':70C 'attack':73C,80C 'audio':66C 'base':60C 'buffer':61C 'class':67C 'driver':68C 'elev':75C 'heap':59C 'heap-bas':58C 'overflow':62C 'physic':79C 'privileg':76C 'unauthor':72C 'usb':65C 'usbaudio.sys':69C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119829","severity":null,"published_at":"2026-11-10T19:19:58+00:00","modified_at":"2026-11-10T19:19:58+00:00","first_seen_at":"2026-11-10T19:24:58+00:00","fetched_at":"2026-11-10T19:24:58+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}