CVE-2011-0638: Microsoft Windows does not properly warn the user before enabling additional Human Interface Device (HID) f...

Security readout for executives and security teams

This CVE describes a Windows behavior where connecting a malicious or compromised USB smartphone could make the computer accept extra keyboard or mouse-like input without a clear warning. That input could be used to run arbitrary programs. The record does not identify exact Windows versions, a patch, CVSS score, or active exploitation. Potential exposure is Windows endpoints where users can connect smartphones or other USB HID-capable devices. Exact affected Windows releases are not specified in the provided sources, so vulnerability managers should validate applicability through vendor guidance and scanner content such as the referenced OVAL definition. Treat this as a physical-access and user-assisted endpoint risk, not an internet-scale emergency. Prioritize controls for privileged workstations, shared environments, and places where untrusted USB devices are likely. The lack of version and patch detail lowers confidence, so validation should come before broad remediation claims. Mitigation focus: Check Microsoft guidance for applicable Windows versions and any available updates.; Restrict untrusted USB and HID devices through endpoint device-control policy.; Limit smartphone USB pairing on sensitive workstations and privileged admin systems..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.