Local privilege escalation via heap overflow

Heap-based buffer overflow in Windows USB Driver in Microsoft Windows before the August 2026 fixes allows local users to gain elevated privileges. Microsoft has not disclosed the vulnerable driver file, request path, or exact heap operation that mishandles local attacker input beyond classifying the flaw as a heap-based buffer overflow in Windows USB Driver code. Exploitation requires local code execution with existing low privileges and is publicly described as an elevation-of-privilege issue on affected Windows client and server builds, with no disclosed remote attack path.