CVE-2026-85935 in Windows
Summary
by MITRE • 10/14/2026
Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a buffer over-read condition within the Universal Serial Bus driver subsystem of Microsoft Windows operating systems. This specific flaw arises when the driver fails to properly validate bounds before accessing memory locations, leading it to read data beyond the allocated buffer boundaries. Such an error typically occurs during the processing of USB device descriptors or control transfers where input parameters are not rigorously checked against expected limits. The consequence is that sensitive information residing in adjacent memory regions can be exposed to processes with local access privileges. This type of vulnerability falls under the category of CWE-126, which denotes Buffer Over-read, a subset of improper limit enforcement errors that compromise data integrity and confidentiality by allowing unauthorized disclosure of internal system states or cryptographic keys stored in nearby memory blocks.
From an operational perspective, this flaw enables an authorized attacker to perform local information disclosure attacks without requiring elevation of privilege beyond their existing user context. The impact is primarily limited to the leakage of potentially useful intelligence rather than direct code execution or denial of service. However, even partial data leaks can be significant in security architectures that rely on memory isolation for trust boundaries. Attackers might leverage this vulnerability to gather information about kernel structures, driver states, or other sensitive data resident in user-mode accessible pages if the over-read extends into such regions. This aligns with ATT&CK technique T1005, which covers Data from Local System, indicating that adversaries can use this flaw as a stepping stone for further reconnaissance within the compromised environment.
Mitigation strategies primarily involve applying vendor-supplied patches that correct the boundary checks in the affected USB driver components. Administrators should ensure that all systems are updated with the latest security updates released by Microsoft to address these specific memory safety issues. Additionally, implementing strict application control policies can limit the execution of untrusted software that might attempt to exploit this condition. For environments where patching is not immediately feasible, monitoring for unusual USB device enumeration patterns or excessive driver errors in system logs may provide early indicators of attempted exploitation attempts. It is also advisable to restrict physical access to machines running vulnerable versions of Windows to prevent unauthorized individuals from connecting malicious USB devices that could trigger the flawed code paths within the driver stack.