CVE-2026-72962 – Windows USB Video Driver Elevation of Privilege Vulnerability

CVE-2026-72962 is a heap-based buffer overflow in the Windows USB Video Driver. An authenticated local attacker can send specially crafted requests to the affected USB video component and, if successful, cross a security boundary and gain elevated Virtual Trust Level 1 (VTL1) privileges. No user interaction is required, although exploitation requires high privileges.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability threatens the confidentiality, integrity, and availability of affected Windows systems, with each rated High in the CVSS metrics. Successful exploitation can allow an attacker who already has authenticated local access and high privileges to cross a security boundary and obtain VTL1 privileges.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Its exploitation assessment is “Exploitation Unlikely,” and exploit code maturity is listed as Unproven. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-72962 is caused by a heap-based buffer overflow (CWE-122) in the Windows USB Video Driver. An authenticated attacker can send specially crafted requests to the USB video component on the local system. The attack has low complexity but requires local access and high privileges. Successful exploitation changes security scope, allowing the attacker to cross a security boundary and gain VTL1 privileges, with potentially high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including listed Server Core installations and applicable x86, x64, and ARM64 editions. Exploitation requires an authenticated local attacker with high privileges to send specially crafted requests. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could enable an attacker with existing privileged local access to cross an additional Windows security boundary and obtain VTL1 privileges. This creates potentially serious consequences for organizations because exploitation carries high confidentiality, integrity, and availability impacts. “When privileged access crosses another security boundary, the potential damage can extend well beyond the original foothold.”

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and can result in VTL1 privilege elevation with high confidentiality, integrity, and availability impacts. Although exploitation is assessed as unlikely and no active exploitation is identified, affected Windows systems should receive the applicable security update as a priority.