CVE-2026-72962

This bug is in Windows’ USB Video Driver, which is used when your computer connects USB video devices (like cameras or certain peripherals). A local attacker who can already access the machine may be able to exploit a memory mistake to gain higher privileges—meaning they could potentially act like an administrator and do more harm than before.

This affects the Windows USB Video Driver on Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. It matters to you if you use these systems and allow any user or process to have local/authorized access that an attacker could leverage. The risk is mainly if an attacker can already interact locally with the affected system (it is not presented as a purely remote, no-access bug in the findings).

This is a RED issue because it’s a local privilege escalation in a core Windows driver component and can lead to full device takeover once an attacker has access. There’s no clear dated public report of exploitation for this exact CVE and no public exploit code on record, but the fix availability is clear—so you should move to patch promptly.