CVE-2026-49804

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows USB Video Class driver. A physically present attacker can cause the driver to process malformed USB video device data, corrupt heap memory in a privileged driver context, and potentially escalate privileges on the affected Windows system. Successful exploitation could allow code execution with high privileges, enabling the attacker to bypass normal user permissions and gain control over the device.

Why it matters to the business

An attacker with physical access could use a malicious or manipulated USB video device to compromise a Windows workstation or server, potentially leading to data theft, local system takeover, malware installation, or lateral movement. The risk is moderated by the need for physical access and user interaction, the low EPSS score, no known exploitation maturity, and absence from the CISA KEV catalog, but affected Windows versions are broadly deployed across enterprise environments, making timely patching and physical access controls important.

How an attack unfolds

An attacker first obtains brief physical access to an affected Windows system or convinces a user to connect a malicious USB video-class device, such as a modified webcam or USB peripheral that presents as a video device. When Windows enumerates the device, the USB Video Driver parses attacker-controlled descriptors or streaming data. Crafted values trigger a heap-based buffer overflow inside the driver. If the attacker controls memory layout reliably, the corruption can be converted into elevated execution in the driver or kernel context. From there, the attacker may disable security controls, create privileged accounts, dump credentials, install persistence, or use the compromised host as a foothold for further activity. There is currently no public exploit maturity indicated and the vulnerability is not listed as known exploited.

How to fix it

Apply the applicable Microsoft security update for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. If exact fixed build numbers are not available from the vulnerability feed, validate against Microsoft’s official security update guidance for the July 2026 release or later cumulative updates. Where immediate patching is not possible, reduce exposure by restricting physical access to systems, disabling unused USB ports where operationally feasible, enforcing device installation restrictions through Group Policy or MDM, blocking unauthorized USB video-class devices, using endpoint device control, and maintaining least-privilege user configurations. High-risk systems such as kiosks, shared workstations, conference-room endpoints, lab machines, and servers with accessible USB ports should be prioritized.

How to confirm the fix worked

Confirm that the relevant Microsoft cumulative security update is installed on each affected system and that the system build is at or above the fixed level published by Microsoft. Validate the version and timestamp of the Windows USB Video Driver, typically usbvideo.sys, against patched Microsoft baselines. Use vulnerability management tools, Windows Update compliance reporting, endpoint management inventory, or authenticated scans to verify patch deployment. For mitigation validation, test that unauthorized USB video-class devices are blocked by device control or device installation policy, and confirm that exceptions are documented and limited to approved hardware.

Typical attack path

1. Gain physical access to an affected Windows system or induce a user to connect a malicious USB video-class device.
2. Present a crafted USB device that is enumerated by Windows as a camera or USB video peripheral.
3. Trigger vulnerable parsing behavior in the Windows USB Video Driver.
4. Exploit the heap-based buffer overflow to corrupt memory in a privileged driver context.
5. Escalate privileges locally on the host.
6. Use elevated access to install persistence, access sensitive data, tamper with security controls, or move laterally.

How to detect it

To determine whether exploitation may have already occurred, focus on evidence of suspicious USB video device connection followed by privileged activity. Review Windows device installation artifacts such as C:\Windows\inf\setupapi.dev.log, Microsoft-Windows-Kernel-PnP events, Microsoft-Windows-DriverFrameworks-UserMode/Operational logs, and device inventory records for newly installed or unusual USB camera/video-class devices. Correlate device insertion times with Security logs for new local administrator accounts, privilege assignment changes, suspicious process creation, service installation, scheduled task creation, security tool tampering, credential dumping behavior, and log clearing. Useful Windows events may include Security 4688 for process creation, 4672 for special privileges assigned, 4720 and 4732 for account and group changes, 4698 for scheduled task creation, 7045 in the System log for service installation, and 1102 for audit log clearing. If Sysmon is deployed, review process creation, driver load, file creation, and registry modification events around the USB insertion timeline. Because no public exploit or campaign-specific indicators are currently known, detection should be behavior-based and timeline-driven rather than relying on static IOCs.

What your security team should do

• Prioritize patch deployment to systems with accessible USB ports, shared physical access, kiosk-like usage, conference-room equipment, and sensitive workstations.
• Apply the latest Microsoft cumulative updates for all affected Windows client and server versions.
• Enable or strengthen endpoint device control policies for USB peripherals, especially USB video-class devices.
• Restrict physical access to servers and privileged workstations, including locking exposed USB ports where appropriate.
• Review recent USB device insertion and driver installation events for unusual or unapproved camera/video devices.
• Harden local privilege boundaries by enforcing least privilege, credential protection, endpoint detection, and tamper protection.
• Monitor Microsoft guidance for fixed build details, exploit publication, or changes in exploitation status, especially because the vulnerability was published 28 days ago.
• Do not treat the low EPSS score as a reason to ignore patching; physical-access privilege escalation flaws can be valuable in targeted attacks.