Microsoft has disclosed a CVSS 9.8 heap-based buffer overflow in the Windows USB Mass Storage Class Driver that allows an unauthorized attacker to execute code over a network, affecting Windows client and server releases from Server 2012 through Windows 11 26H1 and Server 2025.
What Is It
CVE-2026-68839 is a heap-based buffer overflow in the Windows USB Mass Storage Class Driver. Per Microsoft's advisory in the MSRC Update Guide, the flaw allows an unauthorized attacker to execute code over a network. It was published on 2026-09-08 and is currently in "Awaiting Analysis" status at NVD, with Microsoft ([email protected]) as the assigning source.
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That combination is the worst-case profile: network attack vector, low complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. Because the vulnerable component is a kernel-mode storage class driver, successful exploitation carries the potential for code execution at a highly privileged level.
One caveat on that vector: a network attack vector is unusual for a USB mass storage class driver, whose normal input path is a locally attached bus. The AV:N rating is Microsoft's own, and the advisory does not describe the remote reachability path; whether via USB-over-network redirection, remote desktop device redirection, or another mechanism. NVD has not yet completed its own analysis, so no independent scoring exists to compare against. Defenders sizing this should treat the remote-exploitation path as asserted by the vendor but not yet publicly explained.
As of 2026-09-08, CVE-2026-68839 does not appear in CISA's Known Exploited Vulnerabilities catalog, and Microsoft's advisory does not report exploitation or public disclosure. Active exploitation is therefore not confirmed at this time.
What's Vulnerable
Microsoft lists a broad affected set spanning 32-bit, x64, and ARM64 platforms:
- Windows 10: 1607 (< 10.0.14393.9512), 1809 (< 10.0.17763.9245), 21H2 (< 10.0.19044.7725), 22H2 (< 10.0.19045.7725)
- Windows 11: 23H2 (< 10.0.22631.7582), 24H2 (< 10.0.26100.9445), 25H2 (< 10.0.26200.9445), 26H1 (< 10.0.28000.2954)
- Windows Server: 2012 and 2012 Server Core (< 6.2.9200.26349), 2012 R2 and R2 Server Core (< 6.3.9600.23397), 2016 and Server Core (< 10.0.14393.9512), 2019 and Server Core (< 10.0.17763.9245), 2022 (< 10.0.20348.5622), 2025 and Server Core (< 10.0.26100.33438)
Two entries in that list warrant a closer look before you use them as a patch gate. Windows 11 24H2 and Windows Server 2025 both carry 26100 build numbers, but the list cites very different fixed revisions for them, 26100.9445 for the client and 26100.33438 for the server, a gap of more than 20,000 revisions. Elsewhere in the same list, client and server entries sharing a build number also share a revision (1607 and Server 2016 both at 14393.9512, 1809 and Server 2019 both at 17763.9245), which makes the 26100 pair stand out. Administrators validating 26100-family systems should confirm the authoritative build directly against the MSRC entry for CVE-2026-68839 and the KB article for the update their systems received, rather than relying on either number here.
Patch Status
Microsoft has published fixed build numbers for every affected product, indicating updates are available. Remediation is to apply the vendor update that brings each system to at or above the listed build for its version; subject to the 26100 build-number caveat above. Microsoft's Update Guide entry lists no workarounds and no mitigations for this CVE, so installing the security update is the only remediation the vendor offers. Because the CVE is not in the KEV catalog, no BOD 22-01 remediation due date applies to federal civilian agencies; the CVSS 9.8 rating and the absence of any workaround are the reasons to prioritize it regardless.
Sources
- Microsoft Security Response Center; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68839
- NVD, CVE-2026-68839, https://nvd.nist.gov/vuln/detail/CVE-2026-68839
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog