medium · CVSS v3 5.5

CVE-2026-20580

A use-after-free bug in the USB subsystem can cause a system crash, leading to local denial of service when an attacker has system privilege

Overview

A use-after-free bug in the USB subsystem can cause a system crash, leading to local denial of service when an attacker has system privileges. The flaw does not require user interaction and can be triggered by a malicious USB device or driver. It affects recent Windows operating systems and their server counterparts.

Description

In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752.

Impact

Defenders should be aware that the vulnerability can abruptly terminate critical services, impacting availability and potentially disrupting business operations. Because the flaw requires system-level access, it is most relevant to privileged users or compromised systems. Monitoring for unexpected crashes and ensuring timely patching are essential to maintain system stability.

Remediation

Apply the official Microsoft patch (ALPS11412004) to update the USB driver stack. Verify that all USB-related drivers are current and consider disabling unused USB ports or employing device guard policies to limit exposure.

Risk context

The CVSS v3 score of 5.5 indicates a medium severity, and no EPSS data is available. While the vulnerability does not allow remote exploitation, it can still cause significant downtime on compromised systems. Defenders should treat it as a moderate risk and prioritize patching accordingly.

Affected products

  • Microsoft Windows 10
  • Microsoft Windows 11
  • Microsoft Windows Server 2022
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2016

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

usb use-after-free denial-of-service local system-crash patch defense

← All CVEs

Related CVEs

medium

CVE-2026-120334

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

medium

CVE-2026-120343

A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-120278

A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

View analysis

medium

CVE-2026-120309

Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.

View analysis