{"id":"CVE-2026-95999","kind":"vulnerability","aliases":["CVE-2026-95999"],"related":[],"title":"Windows USB Hub Driver: out-of-bounds read lets a local user gain privileges","description":"Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's November 2026 Patch Tuesday fixes an out-of-bounds read (CWE-125) in the Windows USB Hub Driver. A local attacker with low privileges can gain SYSTEM. Microsoft rates it Important (CVSS 7.8), says it is not publicly disclosed and not exploited, and marks exploitation as unlikely. Affects Windows machines where someone can run code locally as a low-privileged user: shared workstations, terminal and RDP servers, build agents and VDI. The attacker needs local access first, so it is a step after another compromise, not a remote entry point.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","local","privilege-escalation","usb","windows"],"not_affected_if":["no-local-access","no-local-accounts"],"how_to_check":"Check that the November 2026 cumulative update for your Windows version is installed (Settings > Windows Update > Update history, or PowerShell Get-HotFix). The exact KB per build is listed in the MSRC Security Update Guide entry for CVE-2026-95999, which I could not read: the API record has no product table.","fix":"Install the November 2026 Windows security update (released 2026-11-10). Exact KB and build numbers: unknown, see the Security Update Guide entry.","status":"open","published_at":"2026-11-10T19:21:56+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","triaged_at":"2026-11-10T19:36:54+00:00","updated_at":"2026-11-10T20:13:23+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:36:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows USB Hub Driver: out-of-bounds read lets a local user gain privileges","impact":"high","summary":"A memory read past the end of a buffer in the Windows USB Hub Driver lets an authorized local user elevate their privileges. The source reports a CVSS score of 7.8 and gives no further detail.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","usb"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains system-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95999 for affected builds and the fixed update.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts"],"who_is_affected":"Windows machines with the USB Hub Driver are the systems involved, and the attacker must already have a local account. The sources do not say which Windows versions or builds are affected, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":4494,"output_tokens":413,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95999 for affected builds and the fixed update.","search":"'-125':43B '-2026':17A,20A '-95999':18A,21A '2026':32B '7.8':64B 'access':108B 'affect':79B 'agent':101B 'allow':133C 'anoth':116B 'attack':52B,105B,136C 'author':135C 'bound':8A,40B,126C 'build':100B 'code':86B 'compromis':117B 'cve':16A,19A 'cvss':63B 'cwe':42B 'disclos':70B 'driver':4A,49B,132C 'elev':138C 'entri':121B 'escal':26B 'exploit':73B,76B 'first':109B 'fix':35B 'gain':14A,57B 'hub':3A,48B,131C 'import':62B 'infrastructur':22B 'let':10A 'local':12A,23B,51B,87B,107B,140C 'low':54B,91B 'low-privileg':90B 'machin':81B 'mark':75B 'microsoft':29B,59B 'need':106B 'novemb':31B 'out-of-bound':5A,37B,123C 'patch':33B 'point':122B 'privileg':15A,25B,55B,92B,139C 'privilege-escal':24B 'public':69B 'rate':60B 'rdp':98B 'read':9A,41B,127C 'remot':120B 'run':85B 'say':65B 'server':99B 'share':94B 'someon':83B 'step':114B 'system':58B 'termin':96B 'tuesday':34B 'unlik':78B 'usb':2A,27B,47B,130C 'user':13A,93B 'vdi':103B 'window':1A,28B,46B,80B,129C 'workstat':95B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the USB Hub Driver are the systems involved, and the attacker must already have a local account. The sources do not say which Windows versions or builds are affected, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","local","privilegeescalation","usb","windows"],"campaign_type":null,"search_a":"'-2026':17A,20A '-95999':18A,21A 'bound':8A 'cve':16A,19A 'driver':4A 'gain':14A 'hub':3A 'let':10A 'local':12A 'out-of-bound':5A 'privileg':15A 'read':9A 'usb':2A 'user':13A 'window':1A","search_b":"'-125':43B '2026':32B '7.8':64B 'access':108B 'affect':79B 'agent':101B 'anoth':116B 'attack':52B,105B 'bound':40B 'build':100B 'code':86B 'compromis':117B 'cvss':63B 'cwe':42B 'disclos':70B 'driver':49B 'entri':121B 'escal':26B 'exploit':73B,76B 'first':109B 'fix':35B 'gain':57B 'hub':48B 'import':62B 'infrastructur':22B 'local':23B,51B,87B,107B 'low':54B,91B 'low-privileg':90B 'machin':81B 'mark':75B 'microsoft':29B,59B 'need':106B 'novemb':31B 'out-of-bound':37B 'patch':33B 'point':122B 'privileg':25B,55B,92B 'privilege-escal':24B 'public':69B 'rate':60B 'rdp':98B 'read':41B 'remot':120B 'run':85B 'say':65B 'server':99B 'share':94B 'someon':83B 'step':114B 'system':58B 'termin':96B 'tuesday':34B 'unlik':78B 'usb':27B,47B 'user':93B 'vdi':103B 'window':28B,46B,80B 'workstat':95B","search_c":"'allow':133C 'attack':136C 'author':135C 'bound':126C 'driver':132C 'elev':138C 'hub':131C 'local':140C 'out-of-bound':123C 'privileg':139C 'read':127C 'usb':130C 'window':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95999","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95999","severity":null,"published_at":"2026-11-10T19:21:56+00:00","modified_at":"2026-11-10T19:21:56+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","fetched_at":"2026-11-10T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95999:2621","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95999","severity":null,"published_at":"2026-11-10T20:13:23+00:00","modified_at":"2026-11-10T20:13:23+00:00","first_seen_at":"2026-11-10T20:13:23+00:00","fetched_at":"2026-11-10T20:13:23+00:00","note":"Read MSRC API record: Important, EoP to SYSTEM, local, not exploited, not disclosed, exploitation unlikely. Affected builds and KBs not in the record, so nothing marked verified and no product rows. No check written: not readable from a repository.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95999"]}],"documents":[{"id":117806,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95999","title":"MSRC Security Update Guide: CVE-2026-95999 (API record)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}