cve-2026-72999

CVE-2026-72999 is an Important-severity Windows USB Hub Driver elevation of privilege vulnerability that Microsoft addressed with released fixes across a broad range of supported Windows client and server releases. The flaw is an out-of-bounds read tracked as CWE-125, and exploitation requires physical access to the target computer so an attacker can plug in a malicious USB device. Successful exploitation could grant SYSTEM privileges. Because the attack is physical rather than remote, the practical risk differs from drive-by web attacks or malicious email attachments, making this tag most relevant to patch management, endpoint security, and USB device policy discussions.