CVE-2026-85341 Microsoft CVE debrief

Who should care

Defenders responsible for Windows systems, particularly those with local access, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-85341 allows an authorized attacker to elevate privileges locally, posing a significant risk to Windows systems.

• Local privilege escalation is possible
• Patching is required to prevent exploitation
• Verify system configurations and inventory
• Monitor for suspicious activity

Technical summary

The Windows USB Video Driver is vulnerable to a heap-based buffer overflow, allowing an authorized attacker to elevate privileges locally. Affected versions include Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows 11 Version 26H2, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, and Windows Server 2025.

Defensive priority

Defenders should prioritize patching this vulnerability, as it allows for local privilege escalation.

Recommended defensive actions

• Patch affected Windows versions
• Verify system configurations and inventory
• Monitor for suspicious activity

Evidence notes

The CVE record and source item provide details on the vulnerability, but do not offer additional information on exploitation or impact. There is no evidence of public exploitation, but defenders should verify system configurations and inventory to assess exposure. The official CVE Program record and NIST NVD detail page provide source-provided CVE metadata and vulnerability assessment. However, the scope of affected systems and potential impact on the organization is not explicitly

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.