Physical code execution via malformed USB input

Improper input validation in the Microsoft Windows Mobile Broadband Driver allows physically proximate attackers to execute arbitrary code. Microsoft identifies malformed input from a malicious USB device but has not disclosed the affected driver function, field, or incorrect validation operation. Physical access to attach that device is required; successful exploitation runs attacker-controlled code on the Windows host.