{"id":"CVE-2026-95965","kind":"vulnerability","aliases":["CVE-2026-95965"],"related":[],"title":"Windows USB Video Driver: heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows USB Video Driver lets an attacker who already has a local, authorized account raise their privileges. The sources give a CVSS score of 7.8 and do not describe any fix or public exploit.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"microsoft"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"microsoft"},{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"microsoft"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"microsoft"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","server","usb-video-driver","usbvideo.sys","windows","workstation"],"not_affected_if":["no-local-access","no-local-accounts"],"how_to_check":"Run winver or Get-ComputerInfo and compare the OS build with the fixed build for your release: Win11 24H2 10.0.26100.9974, Win11 25H2 10.0.26200.9974, Win11 23H2 10.0.22631.7711, Win10 22H2 10.0.19045.7846, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822, Server 2019 10.0.17763.9487, Server 2016 10.0.14393.9688. Builds come from a mirror of the CVE record; confirm on MSRC.","fix":"Install the November 2026 Windows cumulative update that raises your build to at least the fixed build for your release. KB number not confirmed; see the MSRC page for CVE-2026-95965.","status":"open","published_at":"2026-11-10T19:21:53+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:38:04+00:00","updated_at":"2026-11-10T20:19:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows USB Video Driver: heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows USB Video Driver lets an attacker who already has a local, authorized account raise their privileges. The sources give a CVSS score of 7.8 and do not describe any fix or public exploit.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","usb-video-driver"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the machine","analyst_note":"Find the affected Windows builds and the Microsoft patch or KB for CVE-2026-95965 at the MSRC advisory; the NVD entry gives no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Windows machines with the USB Video Driver installed are in scope, and the attacker needs a local account first. The sources do not say which Windows builds or driver versions are affected, so the exact scope is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000686,"input_tokens":4496,"output_tokens":472,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft patch or KB for CVE-2026-95965 at the MSRC advisory; the NVD entry gives no product ranges.","search":"'-2026':15A,18A '-95965':16A,19A '10':21A '11':24A,27A,30A '2016':43A '2019':40A '2022':34A '2025':37A '22h2':22A '23h2':31A '24h2':25A '25h2':28A '7.8':89B 'account':78B 'allow':109C 'alreadi':73B 'attack':71B,112C 'author':77B,111C 'base':60B,101C 'buffer':61B,102C 'cve':14A,17A 'cvss':86B 'describ':93B 'driver':4A,53B,68B,108C 'elev':114C 'escal':48B 'exploit':98B 'fix':95B 'gain':11A 'give':84B 'heap':5A,59B,100C 'heap-bas':58B,99C 'higher':12A 'infrastructur':44B 'let':7A,69B 'local':9A,46B,76B,116C 'local-privilege-escal':45B 'overflow':6A,62B,103C 'privileg':13A,47B,81B,115C 'public':97B 'rais':79B 'score':87B 'server':33A,36A,39A,42A,49B 'sourc':83B 'usb':2A,51B,66B,106C 'usb-video-driv':50B 'usbvideo.sys':54B 'user':10A 'video':3A,52B,67B,107C 'window':1A,55B,65B,105C 'windows':20A,23A,26A,29A,32A,35A,38A,41A 'workstat':56B","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022 and 2025 builds older than the fixed builds are affected, per Microsoft's CVE record. An attacker needs an existing local low-privilege account, so shared machines, terminal servers, VDI and any host where untrusted users or malware can run code matter most. Single-user machines running no untrusted code face lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1022h2","1123h2","1124h2","1125h2","server2016","server2019","server2022","server2025","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windowsserver2016","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","2016","2019","2022","2025","22h2","23h2","24h2","25h2","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","server","usbvideodriver","usbvideosys","windows","workstation"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95965':16A,19A '10':21A '11':24A,27A,30A '2016':43A '2019':40A '2022':34A '2025':37A '22h2':22A '23h2':31A '24h2':25A '25h2':28A 'cve':14A,17A 'driver':4A 'gain':11A 'heap':5A 'higher':12A 'let':7A 'local':9A 'overflow':6A 'privileg':13A 'server':33A,36A,39A,42A 'usb':2A 'user':10A 'video':3A 'window':1A 'windows':20A,23A,26A,29A,32A,35A,38A,41A","search_b":"'7.8':89B 'account':78B 'alreadi':73B 'attack':71B 'author':77B 'base':60B 'buffer':61B 'cvss':86B 'describ':93B 'driver':53B,68B 'escal':48B 'exploit':98B 'fix':95B 'give':84B 'heap':59B 'heap-bas':58B 'infrastructur':44B 'let':69B 'local':46B,76B 'local-privilege-escal':45B 'overflow':62B 'privileg':47B,81B 'public':97B 'rais':79B 'score':87B 'server':49B 'sourc':83B 'usb':51B,66B 'usb-video-driv':50B 'usbvideo.sys':54B 'video':52B,67B 'window':55B,65B 'workstat':56B","search_c":"'allow':109C 'attack':112C 'author':111C 'base':101C 'buffer':102C 'driver':108C 'elev':114C 'heap':100C 'heap-bas':99C 'local':116C 'overflow':103C 'privileg':115C 'usb':106C 'video':107C 'window':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95965","severity":null,"published_at":"2026-11-10T19:21:53+00:00","modified_at":"2026-11-10T19:21:53+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95965:2637","url":"https://app.opencve.io/cve/CVE-2026-95965","severity":null,"published_at":"2026-11-10T20:19:04+00:00","modified_at":"2026-11-10T20:19:04+00:00","first_seen_at":"2026-11-10T20:19:04+00:00","fetched_at":"2026-11-10T20:19:04+00:00","note":"MSRC page is JS-only and unreadable here; builds taken from OpenCVE mirror of Microsoft's CVE record (secondary), so nothing marked verified. Not in KEV, CVSS E:U (exploit unproven). KB numbers not found.","cites":["https://app.opencve.io/cve/CVE-2026-95965","https://nvd.nist.gov/vuln/detail/CVE-2026-95965"]}],"documents":[{"id":118002,"url":"https://app.opencve.io/cve/CVE-2026-95965","title":"OpenCVE: CVE-2026-95965 (mirror of Microsoft CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":118003,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95965","title":"NVD: CVE-2026-95965","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}