CVE-2026-61926

Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally...

EUVD-2026-56623

Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-61926 Windows USB Driver Elevation of Privilege Vulnerability

...

CVE-2026-61926 Windows USB Driver Elevation of Privilege Vulnerability

...

CVE-2026-61926

CVE-2026-61926 : Heap-based buffer overflow in the Windows USB Driver allows an authorized local attacker to perform a local privilege escalation . Exploitation details are not provided beyond the CVSS metrics (LOCAL, LOW complexity, LOW privileges, NONE user interaction; high impact to confident...

CVE-2026-68365

A flaw was found in the Linux kernel's ioedgeport USB serial driver. The driver fails to properly cap the transmit credits received from a connected USB device. This can lead to the txCredits value exceeding the allocated buffer size. A malicious USB device could leverage this vulnerability to...

CVE-2026-68231

A flaw was found in the Linux kernel's media: airspy driver. This vulnerability occurs when the airspystartstreaming function encounters an error, such as a disconnected USB device, and fails to return previously queued buffers. This oversight leads to a resource leak, which can result in a denia...

CVE-2026-68410

A flaw was found in the Linux kernel's Libertas Wi-Fi driver. The helperfirmwarecb function neglects to free a single-stage firmware image after a successful asynchronous load. This leads to a memory leak in the USB firmware-download path. This issue could potentially lead to system instability o...

CVE-2026-68368

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model driver. This vulnerability occurs because the driver fails to properly validate the boundaries of datagrams and Network Transfer Blocks NTBs supplied by a USB host. A malicious USB host can exploit this by crafting specif...

CVE-2026-68367

A flaw was found in the Linux kernel's USB gadget function ftcm. A local attacker could exploit a race condition during the teardown of a USB gadget function. This could lead to a use-after-free vulnerability, potentially causing a system crash denial of service or, in more severe cases, arbitrar...

CVE-2026-68372

A flaw was found in the Linux kernel's USB Type-C port handling. A local user, by unplugging a Thunderbolt dock, can trigger a race condition during the device teardown process. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been...

CVE-2026-68373

A flaw was found in the Linux kernel's at76c50x-usb Wi-Fi driver. A remote attacker could exploit a length underflow vulnerability in the at76guessfreq function by sending a specially crafted Wi-Fi frame. This can cause an out-of-bounds read during the scanning process, potentially leading to a...

CVE-2026-68194

A flaw was found in the Linux kernel's mt76 WiFi driver. When the driver processes a TXRXNOTIFY event on non-Memory-Mapped I/O MMIO buses, such as USB or SDIO, it attempts to call a null function pointer. This can lead to a kernel NULL pointer dereference, causing a system crash and resulting in ...

Windows USB Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-68370

A flaw was found in the Linux kernel's USB gadget dummy Host Controller Driver HCD. A race condition can occur when a shared USB request object fiforeq is prematurely reused before its completion callback has finished. This can lead to the overwriting of the callback pointer, causing a general...

CVE-2026-68374

A flaw was found in the Linux kernel's USB core subsystem. A missing synchronization mechanism in the bosdescriptorsread function allows for a use-after-free vulnerability. This occurs when the udev-bos object is accessed while it is simultaneously being freed, potentially leading to a system cra...

CVE-2026-68227

A flaw was found in the cx231xx media driver within the Linux kernel. This vulnerability arises from incorrect management of device-managed resources, where their lifetime is tied to the parent Universal Serial Bus USB device instead of the USB interface. This can lead to memory leaks when driver...

CVE-2026-68344

A flaw was found in the Linux kernel's USB ATM Asynchronous Transfer Mode driver, specifically in the ueagle-atm module. A local attacker with physical access to a crafted USB device could exploit this vulnerability. By presenting inconsistent USB descriptors that confuse the driver's probe and...

CVE-2026-12052

The USB device-side CDC NCM class control-to-host handler usbdcdcncmcth in subsys/usb/devicenext/class/usbdcdcncm.c builds a fixed-size response for the GETNTBPARAMETERS 28-byte struct ntbparameters and GETNTBINPUTSIZE 8-byte struct ntbinputsize class requests and copies the whole structure into...

CVE-2026-12051

The USB DFU class implementation in Zephyr's new experimental devicenext USB device stack contains a NULL pointer dereference in handledownload subsys/usb/devicenext/class/usbddfu.c. The handler computes MINsetup-wLength, buf-len and passes buf-data to the image write callback without checking th...