Security readout for executives and security teams
Plain-English summary
A person who already has limited access to an affected Windows computer could abuse the USB print driver to gain higher privileges. Successful exploitation could expose or alter sensitive data and disrupt the system. This is a serious local privilege-escalation issue, but the provided sources do not establish active exploitation.
Executive priority
Treat this as a high-priority patching issue, especially where users or service accounts have local access to sensitive Windows systems. It is not presented as an emergency internet-wide threat, but low attack complexity and potentially complete system compromise justify prompt remediation through the standard security-update process.
Technical view
CVE-2025-26639 is an integer overflow or wraparound vulnerability in the Windows USB Print Driver, mapped to CWE-190 and CWE-122. It has CVSS 3.1 score 7.8: local access and low privileges are required, attack complexity is low, no user interaction is required, and successful exploitation can severely affect confidentiality, integrity, and availability.
Likely exposure
Exposure includes the listed Windows 10 21H2/22H2, Windows 11 22H2/22H3/23H2/24H2, Windows Server 2022, Server 2022 23H2 Core, and Windows Server 2025 editions. Organizations with shared workstations, print-enabled servers, or users holding local access should prioritize inventory checks. The bundle does not specify vulnerable-to-fixed build ranges.
Exploitation context
Exploitation requires an authorized attacker with local, low-privileged access; remote unauthenticated exploitation is not indicated. No user interaction is required, and attack complexity is rated low. The bundle marks KEV false and provides no evidence of exploitation in the wild. Exploit maturity is recorded as unproven in the CVSS vector.
Researcher notes
The source bundle identifies the weakness class, affected products, CVSS vector, and vendor advisory, but does not provide root-cause detail, fixed build numbers, public proof-of-concept evidence, or indicators of compromise. Validate product/build applicability and update status through Microsoft’s advisory. Do not interpret KEV false as proof that exploitation is impossible.
Mitigation direction
- Review Microsoft’s CVE advisory for the applicable security update and deployment requirements.
- Apply the Microsoft security update to affected systems using normal change controls.
- Prioritize shared endpoints, administrative workstations, print servers, and other systems with multiple local users.
- Restrict unnecessary local access while patching is incomplete.
- Monitor Microsoft guidance for revised affected-version or remediation details.
Validation and detection
- Inventory Windows editions and builds against the affected products listed in the advisory.
- Confirm the applicable Microsoft security update is installed and deployment completed successfully.
- Check update-management reports for failed, pending, or excluded systems.
- Re-scan patched systems with current vulnerability-management content.
- Investigate unexpected local privilege changes or suspicious activity involving printing components.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-26639 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C1.85.9microsoftVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Windows USB Print Driver Elevation of Privilege VulnerabilityCVE reference, microsoft · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.