CVE-2026-32223

CVE-2026-32223 is a heap-based buffer overflow vulnerability in the Windows USB Print Driver that could allow an attacker to escalate privileges through physical access to an affected system. The flaw exists in the driver's memory handling when processing USB print device communications. This vulnerability affects Windows systems running vulnerable versions of the USB Print Driver component. The vulnerability carries a CVSS score of 6.8 (Medium severity) with a physical attack vector, low complexity, and no authentication requirements. Exploitation could result in high-impact consequences across confidentiality, integrity, and availability. The physical attack requirement significantly constrains the practical threat landscape, as an attacker must have direct access to the targeted device. There is currently no evidence of active exploitation in the wild, as indicated by its absence from the Known Exploited Vulnerabilities catalog and inactive status on the Hot List. The extremely low EPSS score of 0.00075 further suggests minimal real-world exploitation activity. However, the moderate FAUCET Risk Score of 45.0 indicates organizations should still prioritize patching this vulnerability as part of their standard security maintenance procedures.