CVE-2026-72962

Windows USB Video Driver Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 26th percentile. A vendor fix is available.

CVSS 3.18.2High EPSS percentile26th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your Windows version (Windows 10/11 or Windows Server 2019/2022/2025) and current update level.
Update Windows to the fixed version for your specific release:
- Windows 10: 10.0.17763.9245, 10.0.19044.7725, or 10.0.19045.7725
- Windows 11: 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, or 10.0.28000.2954
- Windows Server 2019: 10.0.17763.9245
- Windows Server 2022: 10.0.20348.5622
- Windows Server 2025: 10.0.26100.33438
If you cannot patch immediately, reduce risk by limiting who has local access and by restricting which USB video-capable devices can be used on workstations.
Verify after patching that the installed build matches one of the fixed versions above, and re-check Windows Update for any pending remainder updates.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-72962 is a Windows USB Video Driver bug that can let someone with access to your computer gain higher privileges; most small businesses should patch soon because it’s a high-impact local elevation issue.

CVE-2026-72962 is a local privilege escalation weakness (CWE-122) in the Windows USB Video Driver caused by a heap-based buffer overflow; it can be triggered by an authorized attacker to gain elevated privileges.

If you're affected

Full control of the device
Malware can run with admin rights
System disruption and data loss risk

What is it

This bug is in Windows’ USB Video Driver, which is used when your computer connects USB video devices (like cameras or certain peripherals). A local attacker who can already access the machine may be able to exploit a memory mistake to gain higher privileges—meaning they could potentially act like an administrator and do more harm than before.

Who is affected

This affects the Windows USB Video Driver on Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. It matters to you if you use these systems and allow any user or process to have local/authorized access that an attacker could leverage. The risk is mainly if an attacker can already interact locally with the affected system (it is not presented as a purely remote, no-access bug in the findings).

How urgent is it

This is a RED issue because it’s a local privilege escalation in a core Windows driver component and can lead to full device takeover once an attacker has access. There’s no clear dated public report of exploitation for this exact CVE and no public exploit code on record, but the fix availability is clear—so you should move to patch promptly.

What to do — in detail

Identify exposure on your machines
- Determine which OS you run: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025.
- Get the current build number (the “10.0.xxxxx.xxxx” style version) from your system settings or via your management tools.
Compare to the fixed versions
- Windows 10 is fixed if the OS build is one of:
  - 10.0.17763.9245
  - 10.0.19044.7725
  - 10.0.19045.7725
- Windows 11 is fixed if the OS build is one of:
  - 10.0.22631.7582
  - 10.0.26100.9445
  - 10.0.26200.9445
  - 10.0.28000.2954
- Windows Server 2019 is fixed if build is:
  - 10.0.17763.9245
- Windows Server 2022 is fixed if build is:
  - 10.0.20348.5622
- Windows Server 2025 is fixed if build is:
  - 10.0.26100.33438
Upgrade/patch plan
- Apply the Microsoft update that brings your systems to the fixed build listed for your edition and branch.
- After reboot, re-check the build number to confirm it matches one of the fixed versions.
Temporary workaround if patching is delayed
- Tighten local access: restrict who can log on interactively and reduce opportunities for an attacker to obtain “authorized” access.
- Control USB usage as feasible: limit which USB devices are allowed/used for work activities, especially USB video peripherals.
What to monitor
- Look for unusual local admin behavior and privilege changes around the time of any USB device connections.
- Use standard endpoint logging/alerting (as you already do) to flag suspicious processes that appear after device use.
KEV / due dates
- This CVE is not listed in the CISA KEV catalog in the provided findings, so there is no KEV-specific due date here.

Technical context

Severity: HIGH (CVSS 8.2) with a verdict of RED for urgency. Weakness type is CWE-122 (heap-based buffer overflow). Mechanism/impact: heap corruption in the Windows USB Video Driver can allow an authorized attacker to elevate privileges locally. Attack vector: local, requires attacker ability consistent with an “authorized attacker” premise (not shown as unauthenticated/remote). Exploitation status: no clear dated press claim of exploitation for this CVE and no public exploit code available in the provided findings; KEV is not listed. EPSS is provided as a prediction only (do not use it as proof of exploitation). The PULSE summary notes new press attention (actor: Qualys) but that is not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS26th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 26th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 13 days, from the signal feeds we watch.

2026-09-21Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 18 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Scored 8.2 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable