CVE-2026-69584

CVE-2026-69584 is an integer overflow/wraparound flaw (CWE-190) in the Windows USB Video Driver, the inbox driver that handles USB Video Class devices such as webcams. An authorized attacker with low privileges on a local machine can trigger the overflow through the driver's processing of USB video data, causing memory corruption at the kernel level. Successful exploitation elevates the attacker's privileges to administrator/SYSTEM level, yielding high confidentiality, integrity and availability impact — effectively full local compromise of the host. Because the driver ships as a built-in Windows component, essentially the entire Windows installed base is in scope, though real-world exploitation requires an attacker to already run low-privileged code on the target, typically on a machine with a USB video device attached. There is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days, so no active exploitation is currently known.

What to do: Apply Microsoft's update for CVE-2026-69584 via Windows Update on all affected systems, prioritizing workstations, VDI/Remote Desktop hosts, and shared or kiosk machines where untrusted users can execute code locally. No public exploits or workarounds are known, so standard patch-cycle timing is reasonable; after patching, confirm the updated USB Video Driver (usbvideo.sys) is in place on high-risk hosts.