{"id":"CVE-2026-96057","kind":"vulnerability","aliases":["CVE-2026-96057"],"related":[],"title":"Windows USB driver heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.","summary":"Microsoft's CVE record (published 2026-11-10) describes a heap-based buffer overflow (CWE-122) in the Windows USB Driver that lets an authorized local attacker elevate privileges. CVSS 3.1 7.8 (AV:L/PR:L/UI:N), exploit code maturity 'unproven' in the vector. No exploitation or public PoC found. The KB article names are not in the record I could read; the MSRC page itself did not load.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"windows-10","fixed":["10.0.14393.9688","10.0.17763.9487","10.0.19044.7846","10.0.19045.7846"],"affected":"1607 < 10.0.14393.9688; 1809 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846","ecosystem":"vendor"},{"name":"windows-11","fixed":["10.0.22631.7711","10.0.26100.9974","10.0.26200.9974","10.0.28000.3501","10.0.26300.9974"],"affected":"23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974","ecosystem":"vendor"},{"name":"windows-server","fixed":["10.0.14393.9688","10.0.17763.9487","10.0.20348.5870","10.0.26100.33822"],"affected":"2016 < 10.0.14393.9688; 2019 < 10.0.17763.9487; 2022 < 10.0.20348.5870; 2025 < 10.0.26100.33822","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","local-privilege-escalation","usb","windows","windows-server"],"not_affected_if":["patched-build"],"how_to_check":"Get the build with winver, or (Get-ComputerInfo).OsBuildNumber plus UBR (reg query 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' /v UBR), and compare to the fixed build for your release: 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Server 2022 10.0.20348.5870; 23H2 10.0.22631.7711; 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H2 10.0.26300.9974; Server 2025 10.0.26100.33822; 26H1 10.0.28000.3501. Below that = exposed.","fix":"Install the November 2026 Windows cumulative update that brings your release to the build listed above or later. KB number not confirmed.","status":"open","published_at":"2026-11-10T19:22:03+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","triaged_at":"2026-11-10T19:36:39+00:00","updated_at":"2026-11-10T19:58:25+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:36:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows USB Driver: heap overflow lets a local user gain administrator rights","impact":"high","summary":"A heap-based buffer overflow in the Windows USB driver lets a user who already has access to the machine raise their privileges. The sources do not describe the exact trigger or the affected Windows builds.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level control of the Windows machine","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96057 to confirm affected Windows builds, the fixed build and any patch name.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Windows machine with the affected USB driver is exposed to a local user who is already signed in. Attackers on the network or the internet cannot trigger it on their own, per the sources' local-privilege description. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":4492,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft security update guide entry for CVE-2026-96057 to confirm affected Windows builds, the fixed build and any patch name.","search":"'-10':20A,43B '-11':22A,42B '-122':52B '-2026':14A,17A '-96057':15A,18A '2026':41B '3.1':67B '7.8':68B 'allow':114C 'articl':88B 'attack':63B,117C 'author':61B,116C 'av':69B 'base':48B,107C 'buffer':49B,108C 'code':74B 'could':96B 'cve':13A,16A,38B 'cvss':66B 'cwe':51B 'describ':44B 'driver':3A,57B,113C 'elev':64B,119C 'escal':30B 'exploit':73B,81B 'found':85B 'gain':10A 'heap':4A,47B,106C 'heap-bas':46B,105C 'higher':11A 'infrastructur':26B 'kb':87B 'l/pr':70B 'l/ui':71B 'let':6A,59B 'load':104B 'local':8A,28B,62B,121C 'local-privilege-escal':27B 'matur':75B 'microsoft':36B 'msrc':99B 'n':72B 'name':89B 'overflow':5A,50B,109C 'page':100B 'poc':84B 'privileg':12A,29B,65B,120C 'public':83B 'publish':40B 'read':97B 'record':39B,94B 'server':25A,35B 'unproven':76B 'usb':2A,31B,56B,112C 'user':9A 'vector':79B 'window':1A,32B,34B,55B,111C 'windows':19A,21A,24A 'windows-serv':33B 'windows-server':23A","nicknames":[],"mitigations":[],"who_affected":"Any Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) or Windows Server (2016, 2019, 2022, 2025) machine below the fixed build listed by Microsoft. The attacker needs to already run code locally with low privileges, so shared workstations, terminal servers, VDI and build hosts matter most. Machines already at or above the fixed build can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T19:58:25Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96057","run_id":2586},"products":{"at":"2026-11-10T19:58:25Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96057","run_id":2586},"who_affected":{"at":"2026-11-10T19:58:25Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-96057","run_id":2586}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["windows10","windows11","windowsserver"],"ptokens":["10","11","server","windows"],"labels":["high","infrastructure","localprivilegeescalation","usb","windows","windowsserver"],"campaign_type":null,"search_a":"'-10':20A '-11':22A '-2026':14A,17A '-96057':15A,18A 'cve':13A,16A 'driver':3A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'server':25A 'usb':2A 'user':9A 'window':1A 'windows':19A,21A,24A 'windows-server':23A","search_b":"'-10':43B '-11':42B '-122':52B '2026':41B '3.1':67B '7.8':68B 'articl':88B 'attack':63B 'author':61B 'av':69B 'base':48B 'buffer':49B 'code':74B 'could':96B 'cve':38B 'cvss':66B 'cwe':51B 'describ':44B 'driver':57B 'elev':64B 'escal':30B 'exploit':73B,81B 'found':85B 'heap':47B 'heap-bas':46B 'infrastructur':26B 'kb':87B 'l/pr':70B 'l/ui':71B 'let':59B 'load':104B 'local':28B,62B 'local-privilege-escal':27B 'matur':75B 'microsoft':36B 'msrc':99B 'n':72B 'name':89B 'overflow':50B 'page':100B 'poc':84B 'privileg':29B,65B 'public':83B 'publish':40B 'read':97B 'record':39B,94B 'server':35B 'unproven':76B 'usb':31B,56B 'vector':79B 'window':32B,34B,55B 'windows-serv':33B","search_c":"'allow':114C 'attack':117C 'author':116C 'base':107C 'buffer':108C 'driver':113C 'elev':119C 'heap':106C 'heap-bas':105C 'local':121C 'overflow':109C 'privileg':120C 'usb':112C 'window':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96057","severity":null,"published_at":"2026-11-10T19:22:03+00:00","modified_at":"2026-11-10T19:22:03+00:00","first_seen_at":"2026-11-10T19:25:29+00:00","fetched_at":"2026-11-10T19:25:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96057:2586","url":"https://cveawg.mitre.org/api/cve/CVE-2026-96057","severity":null,"published_at":"2026-11-10T19:58:25+00:00","modified_at":"2026-11-10T19:58:25+00:00","first_seen_at":"2026-11-10T19:58:25+00:00","fetched_at":"2026-11-10T19:58:25+00:00","note":"Microsoft CNA CVE record (cveawg) gives affected/fixed builds; MSRC update guide page did not load so KB names unknown. No exploitation or PoC seen; social search skipped. No check written: build comparison needs host state, not repo files.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-96057"]}],"documents":[{"id":117722,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-96057","title":"CVE-2026-96057 CVE record published by Microsoft (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}