CVE-2026-49794

What it actually does

CVE-2026-49794 is an out-of-bounds read vulnerability in the Windows USB Audio Class driver, usbaudio.sys. A malicious or malformed physical USB audio device can cause the driver to read memory outside the intended buffer during device enumeration or audio class descriptor handling. The known impact is information disclosure: sensitive kernel or system memory may be exposed to the attacker through crafted USB interactions. The vulnerability does not directly provide code execution, privilege escalation, persistence, or denial of service based on the published description, but disclosed memory may help bypass exploit mitigations or support follow-on attacks in a hands-on physical compromise scenario.

Why it matters to the business

The primary business risk is data exposure from Windows workstations or servers that allow physical USB access. Because exploitation requires physical access and no public exploitation or KEV listing is currently reported, broad internet-scale risk is low; however, shared workstations, kiosks, conference-room systems, labs, point-of-sale endpoints, and devices in semi-public areas are more exposed. Successful exploitation could disclose sensitive memory contents and may assist an attacker attempting a larger physical-access compromise. Organizations with strict data handling, regulated environments, or untrusted physical access zones should prioritize patching and USB control enforcement.

How an attack unfolds

An attacker needs physical access to a vulnerable Windows system or the ability to introduce a malicious USB audio-class device into the system. The attacker connects a crafted USB device that advertises itself as an audio device and supplies malformed descriptors or responses designed to trigger the out-of-bounds read in usbaudio.sys. During plug-and-play enumeration or driver interaction, Windows loads or interacts with the USB Audio Class driver. The malformed data causes the driver to read beyond an expected buffer and return or expose memory contents through the USB interaction. The attacker then analyzes the leaked data for sensitive information, kernel memory layout details, credentials, cryptographic material, or values useful for chaining with another local or physical exploit.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49794 for all affected Windows versions, including supported Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 releases. Because no per-product fixed build numbers were provided, use the latest cumulative update for the affected operating system release from Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog. Where immediate patching is not possible, reduce exposure by blocking untrusted USB peripherals, disabling or restricting USB audio devices through device control policy, enforcing physical security controls, disabling unused USB ports in firmware where operationally acceptable, and using endpoint device-control tooling to allow only approved USB device classes or hardware IDs. Prioritize endpoints in public, shared, or physically accessible locations.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative security update released for this issue or a later cumulative update. Validate patch deployment through Windows Update history, enterprise patch management compliance, or PowerShell inventory of installed hotfixes and OS build numbers. Confirm that usbaudio.sys has been updated to the patched version delivered by the applicable cumulative update. Test representative systems by connecting approved USB audio devices and confirming normal functionality while ensuring unauthorized USB audio-class devices are blocked where device control is required. For exposure validation, inventory systems with active USB ports and systems that have recently enumerated USB audio devices, especially in shared or physically accessible areas.

Typical attack path

1. Obtain brief physical access to a Windows endpoint or server with an exposed USB port.
2. Connect a malicious USB device that identifies as a USB audio-class peripheral.
3. Trigger Windows plug-and-play enumeration and loading or interaction with usbaudio.sys.
4. Send crafted USB audio descriptors or protocol responses that cause an out-of-bounds read.
5. Capture any memory contents returned or exposed through the malicious device interaction.
6. Use the disclosed information directly or to support additional local/physical exploitation.

How to detect it

To determine whether this was already exploited, focus on evidence of suspicious USB audio-class device attachment rather than network indicators. Review Windows event logs and endpoint telemetry for new or unusual USB devices that identify as audio peripherals, especially on systems in shared or public locations. Useful log sources include Microsoft-Windows-Kernel-PnP/Configuration, Microsoft-Windows-DriverFrameworks-UserMode/Operational, System event logs, device installation logs such as C:\Windows\INF\setupapi.dev.log, EDR device-control telemetry, and asset-management USB inventory. Look for first-time USB audio device installation, unexpected hardware IDs, rapid connect/disconnect activity, devices installed outside business hours, or installation of usbaudio.sys-related device instances without a known business reason. Because the vulnerability is an information disclosure in a kernel driver and may not create a crash or durable artifact, absence of logs does not prove absence of exploitation. Correlate suspicious USB events with physical access logs, badge records, CCTV, helpdesk reports, and endpoint activity following the device connection.

• usbaudio.sys
• USB\\Class_01
• MEDIA\\
• C:\\Windows\\INF\\setupapi.dev.log
• Microsoft-Windows-Kernel-PnP/Configuration
• Microsoft-Windows-DriverFrameworks-UserMode/Operational
• USB Audio Device
• USB Composite Device

What your security team should do

• Patch affected Windows client and server systems with the latest applicable Microsoft cumulative security update, prioritizing physically accessible endpoints.
• Enforce device control policies that block unapproved USB audio devices and other untrusted USB peripherals.
• Review physical security for kiosks, shared workstations, conference-room systems, reception devices, labs, and other systems where attackers could access USB ports.
• Inventory recent USB audio device connections across endpoint telemetry and investigate unknown or suspicious devices.
• Monitor for unusual USB enumeration events involving audio-class devices, especially outside normal business locations or hours.
• For high-risk systems, disable unused USB ports through BIOS/UEFI settings, operating system policy, or physical port blockers where feasible.
• Because exploitation requires physical access and EPSS is currently low with no known KEV listing, treat this as a targeted physical-access risk rather than an internet-facing emergency, but include it in the normal Windows patch cycle.