CVE-2026-105006

Undergoing Analysis Undergoing Analysis - In Progress

Use After Free in HID Class Driver Enables Privilege Escalation

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Microsoft Corporation

Description

Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105006

EUVD

EUVD-2026-100395

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Windows	10 Version 1607 10.0.14393.0
Microsoft	Windows	10 Version 1809 10.0.17763.0
Microsoft	Windows	10 Version 21H2 10.0.19044.0
Microsoft	Windows	10 Version 22H2 10.0.19045.0
Microsoft	Windows	11 version 23H2 10.0.22631.0
Microsoft	Windows	11 Version 23H2 10.0.22631.0
Microsoft	Windows	11 Version 24H2 10.0.26100.0
Microsoft	Windows	11 Version 25H2 10.0.26200.0
Microsoft	Windows	11 version 26H1 10.0.28000.0
Microsoft	Windows	11 Version 26H2 10.0.26300.0
Microsoft	Windows	Server 2012 R2 6.3.9600.0
Microsoft	Windows	Server 2012 R2 (Server Core installation) 6.3.9600.0
Microsoft	Windows	Server 2016 10.0.14393.0
Microsoft	Windows	Server 2016 (Server Core installation) 10.0.14393.0
Microsoft	Windows	Server 2019 10.0.17763.0
Microsoft	Windows	Server 2019 (Server Core installation) 10.0.17763.0
Microsoft	Windows	Server 2022 10.0.20348.0
Microsoft	Windows	Server 2025 10.0.26100.0
Microsoft	Windows	Server 2025 (Server Core installation) 10.0.26100.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the HID class driver of Microsoft Windows. It allows an unauthorized attacker to elevate their privileges by exploiting a physical attack vector.

Detection Guidance

Detection of this vulnerability requires monitoring for unusual HID class driver behavior or physical attack patterns. Check Windows Event Logs for HID-related errors or crashes. Use tools like Process Monitor to observe HID driver interactions. Ensure all Windows systems are updated with the latest patches from Microsoft.

Impact Analysis

An attacker with physical access could exploit this to gain higher privileges on your system, potentially allowing them to install malicious software, access sensitive data, or take control of your device.

Compliance Impact

The vulnerability allows unauthorized privilege escalation via physical access, which could lead to unauthorized data access or modification. This may violate compliance requirements for data protection standards like GDPR (data confidentiality) and HIPAA (access controls).

Mitigation Strategies

Apply the latest security updates from Microsoft to patch the HID class driver vulnerability. Ensure all affected Windows versions listed in the CPEs are updated immediately.

Hi! I’m here to help you understand CVE-2026-105006. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70