CVE-2026-72999 in Windows
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Windows USB Hub Driver allows an unauthorized attacker to elevate privileges with a physical attack.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an out-of-bounds read within the Microsoft Windows USB Hub Driver represents a critical security flaw that compromises the integrity of the operating system's hardware abstraction layer. This specific defect occurs when the driver processes input from connected Universal Serial Bus devices, failing to properly validate memory boundaries before reading data structures associated with hub configurations or device descriptors. The root cause lies in insufficient boundary checks during the parsing of USB control transfers, allowing a malicious actor to trigger an access violation that reads beyond the allocated buffer space into adjacent kernel-mode memory regions. This type of flaw is classically categorized under CWE-125, which defines out-of-bounds read vulnerabilities where software accesses memory outside the intended range without writing data, potentially leading to information disclosure or further exploitation chains.
The operational impact of this vulnerability is severe due to its potential for privilege escalation through physical attack vectors. An attacker with direct physical access to a target machine can utilize specially crafted USB hardware devices that emulate malicious hub behaviors. By sending malformed control requests to the host controller, the attacker forces the driver to execute memory reads from arbitrary kernel addresses. While an out-of-bounds read alone may primarily result in information disclosure by leaking sensitive kernel data such as pointers or cryptographic keys, it serves as a foundational primitive for more complex attacks. In many scenarios, this leakage can facilitate subsequent exploitation techniques that lead to full system compromise and elevation of privileges from user-level context to SYSTEM level access. This aligns with the MITRE ATT&CK framework technique T1059, specifically relating to command-line interface or script execution enabled by prior privilege escalation steps derived from such low-level kernel exploits.
Mitigation strategies for this vulnerability require a multi-layered approach focusing on both software patching and physical security controls. The primary defense is the immediate application of vendor-provided security updates that address the buffer validation logic within the USB Hub Driver component. Organizations must ensure that all endpoints are configured to receive automatic security patches or are regularly audited against known vulnerable versions. Beyond software remediation, implementing strict device control policies via Group Policy Objects can restrict which USB devices are permitted to connect to corporate networks and workstations. Utilizing whitelisting mechanisms for hardware IDs prevents unauthorized peripherals from establishing communication with the host system. Additionally, physical security measures such as locked server rooms, port blockers on critical endpoints, and monitoring of physical access logs serve as essential compensating controls to mitigate the risk posed by attackers capable of physically interacting with target infrastructure.