---
id: "CVE-2026-95999"
page: "https://infrastack.ai/live/CVE-2026-95999"
kind: "vulnerability"
aliases: ["CVE-2026-95999"]
title: "Windows USB Hub Driver: out-of-bounds read lets a local user gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local", "privilege-escalation", "usb", "windows"]
not_affected_if: ["no-local-access", "no-local-accounts"]
published_at: "2026-11-10T19:21:56+00:00"
first_seen_at: "2026-11-10T19:25:26+00:00"
updated_at: "2026-11-10T20:13:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95999", "first_seen_at": "2026-11-10T19:25:26+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95999", "first_seen_at": "2026-11-10T20:13:23+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95999"]}]
exploit_sources: []
---

# Windows USB Hub Driver: out-of-bounds read lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-95999 (this .md is for agents)

Microsoft's November 2026 Patch Tuesday fixes an out-of-bounds read (CWE-125) in the Windows USB Hub Driver. A local attacker with low privileges can gain SYSTEM. Microsoft rates it Important (CVSS 7.8), says it is not publicly disclosed and not exploited, and marks exploitation as unlikely. Affects Windows machines where someone can run code locally as a low-privileged user: shared workstations, terminal and RDP servers, build agents and VDI. The attacker needs local access first, so it is a step after another compromise, not a remote entry point.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check that the November 2026 cumulative update for your Windows version is installed (Settings > Windows Update > Update history, or PowerShell Get-HotFix). The exact KB per build is listed in the MSRC Security Update Guide entry for CVE-2026-95999, which I could not read: the API record has no product table.

## Fix

Install the November 2026 Windows security update (released 2026-11-10). Exact KB and build numbers: unknown, see the Security Update Guide entry.

## Timeline

- 2026-11-10T19:25:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95999
- 2026-11-10T20:13:23+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95999 — Read MSRC API record: Important, EoP to SYSTEM, local, not exploited, not disclosed, exploitation unlikely. Affected builds and KBs not in the record, so nothing marked verified and no product rows. No check written: not readable from a repository.

## Documents

- [advisory] MSRC Security Update Guide: CVE-2026-95999 (API record) https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95999

## From the sources

Out-of-bounds read in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_