CVE-2026-58528

What it actually does

CVE-2026-58528 is an out-of-bounds read vulnerability in the Windows USB Audio Class driver, usbaudio.sys. A physically present attacker can attach or manipulate a crafted USB audio device so the driver parses malformed USB audio descriptors or data structures and reads memory outside the intended buffer. The published vector is physical access, low complexity, no privileges, and no user interaction. The primary impact is information disclosure, but the assigned CVSS vector also indicates potential high confidentiality, integrity, and availability impact, which suggests disclosed memory or driver state could potentially support broader compromise or system instability depending on exploit conditions.

Why it matters to the business

An attacker with physical access to an affected Windows workstation or server could use a malicious USB audio device to expose sensitive system memory and potentially destabilize or compromise the endpoint. This is most relevant for laptops, shared workstations, kiosks, lab systems, conference-room PCs, helpdesk machines, and servers where USB ports are physically accessible. Although the vulnerability is not currently listed in CISA KEV and no public exploit maturity is reported, the affected product range is broad across supported Windows client and server releases, so organizations should treat remediation as part of normal high-priority Windows patching and physical port-control hardening.

How an attack unfolds

An attacker needs physical access to an affected Windows system or the ability to cause a malicious USB audio-class device to be connected. The attacker prepares a USB device that presents itself as a USB audio peripheral with malformed descriptors or crafted responses designed to trigger incorrect bounds handling in usbaudio.sys. When Windows enumerates the device, the USB stack loads the USB Audio Class driver and parses attacker-controlled device data. The vulnerable driver reads beyond a valid memory boundary and may disclose kernel or process memory contents through the USB interaction, crash the system, or expose data useful for follow-on local exploitation. Because exploitation is physical and requires no account credentials or user interaction beyond device connection, risk is concentrated where attackers can access unlocked or unattended systems, exposed USB ports, or supply-chain/peripheral workflows.

How to fix it

Apply the Microsoft security update that fixes CVE-2026-58528 for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. No fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Intune, Configuration Manager, or the Microsoft Update Catalog to deploy the applicable cumulative update for the affected release. Where immediate patching is not possible, reduce exposure by restricting physical access, disabling unused USB ports in firmware or operating system policy, using device installation restrictions for USB audio-class devices, enforcing endpoint device-control policies, and monitoring for unexpected USB audio device connections. High-risk systems such as kiosks, public-facing workstations, conference-room PCs, and servers with accessible USB ports should be prioritized.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft cumulative update or security update released to address CVE-2026-58528 for its Windows version. Validate through centralized patch inventory, Windows Update history, Configuration Manager/Intune compliance reporting, or PowerShell queries such as Get-HotFix and OS build checks against Microsoft’s advisory. Confirm that usbaudio.sys has a patched file version according to Microsoft’s file manifest for the relevant Windows release. For mitigation validation, test that unauthorized USB audio devices are blocked by device-control policy, Group Policy device installation restrictions, BIOS/UEFI port controls, or endpoint protection controls. On representative systems, connect an approved USB audio device after patching to verify normal audio functionality remains intact.

Typical attack path

1. Obtain brief physical access to an affected Windows endpoint or position a malicious USB audio-class peripheral for connection.
2. Connect a crafted USB device that identifies as a USB audio device.
3. Allow Windows Plug and Play enumeration to load usbaudio.sys and process the malicious USB audio descriptors or control responses.
4. Trigger the out-of-bounds read condition in the driver during device initialization or interaction.
5. Collect disclosed memory or observe system behavior over the USB channel.
6. Use any leaked sensitive information, kernel memory details, or stability impact to support further local compromise, bypass defenses, or disrupt the endpoint.

How to detect it

To assess whether this was already exploited, focus on physical-device telemetry rather than network indicators. Review Windows Plug and Play, Driver Framework, Kernel-PnP, DeviceSetupManager, Code Integrity, endpoint device-control, and EDR USB-device inventory logs for unexpected USB audio-class device connections. Correlate suspicious USB audio device insertion times with crashes, bugchecks, memory-dump creation, endpoint alerts, or unusual local activity. Important Windows Event Log sources include Microsoft-Windows-Kernel-PnP/Configuration, Microsoft-Windows-DriverFrameworks-UserMode/Operational, Microsoft-Windows-DeviceSetupManager/Admin and Operational, System logs for driver load and device install events, and security/EDR telemetry that records USB vendor ID, product ID, serial number, device class, and driver file. Look specifically for new or unusual devices using the usbaudio.sys driver, device class Media, USB audio class identifiers, unknown manufacturers, repeated connect/disconnect cycles, failed device starts, or system crashes mentioning usbaudio.sys shortly after USB insertion. If available, examine memory dumps and minidumps for bugchecks with usbaudio.sys on the stack. There are no known threat actors or public exploitation campaigns in the provided data, so detections should be behavior- and artifact-based.

• usbaudio.sys
• USB\\Class_01
• USB\\Class_01&SubClass_01
• USB\\Class_01&SubClass_02
• USB\\Class_01&SubClass_03
• USB Audio Device
• USB Audio 1.0
• USB Audio 2.0
• Microsoft-Windows-Kernel-PnP/Configuration
• Microsoft-Windows-DriverFrameworks-UserMode/Operational
• Microsoft-Windows-DeviceSetupManager/Admin
• Microsoft-Windows-DeviceSetupManager/Operational
• Driver Name: usbaudio.sys
• Service Name: usbaudio
• Device Class: MEDIA
• ClassGuid: {4d36e96c-e325-11ce-bfc1-08002be10318}
• BugCheck
• MEMORY.DMP
• C:\\Windows\\Minidump\\
• C:\\Windows\\MEMORY.DMP

What your security team should do

• Prioritize patch deployment to physically exposed systems, shared workstations, kiosks, conference-room endpoints, lab devices, and servers with accessible USB ports.
• Use centralized endpoint management to identify Windows 10, Windows 11, and Windows Server systems in the affected version list and track update compliance.
• Implement or tighten USB device-control policies, especially blocking unapproved USB audio-class devices where business need is limited.
• Restrict physical access to sensitive endpoints and ensure unattended systems are locked or placed in controlled areas.
• Monitor Windows device-installation and Plug and Play events for unexpected USB audio devices, particularly on high-value or physically exposed systems.
• Review endpoint crash telemetry and kernel bugchecks involving usbaudio.sys as possible exploitation or malformed-device testing indicators.
• Educate helpdesk and facilities teams not to connect unknown USB audio peripherals, dongles, conference devices, or promotional USB devices to corporate systems.
• Because there is no current KEV listing, ransomware association, or known public exploit maturity reported, handle as high-priority patching rather than emergency internet-scale incident response unless local physical exposure is significant.