MicrosoftCVE-2026-69270

Microsoft Windows: heap buffer overflow

High7.8CVE-2026-69270 · Published Sep 8, 2026 · updated Sep 24, 2026

Heap-based buffer overflow in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Windows 10 Version 1607 Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows 10 Version 1809 Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245
Windows 10 Version 21H2 Product	>= 10.0.19044.0, < 10.0.19044.7725	10.0.19044.7725
Windows 10 Version 22H2 Product	>= 10.0.19045.0, < 10.0.19045.7725	10.0.19045.7725
Windows 11 Version 23H2 Product	>= 10.0.22631.0, < 10.0.22631.7582	10.0.22631.7582
Windows 11 Version 24H2 Product	>= 10.0.26100.0, < 10.0.26100.9445	10.0.26100.9445
Windows 11 Version 25H2 Product	>= 10.0.26200.0, < 10.0.26200.9445	10.0.26200.9445
Windows 11 version 23H2 Product	>= 10.0.22631.0, < 10.0.22631.7582	10.0.22631.7582
Windows 11 version 26H1 Product	>= 10.0.28000.0, < 10.0.28000.2954	10.0.28000.2954
Windows Server 2012 Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 (Server Core installation) Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 R2 Product	>= 6.3.9600.0, < 6.3.9600.23398	6.3.9600.23398

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-20, CWE-122

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Sep 8	Microsoft Skype for Business: spoofing High8.3Sep 8 CVE-2026-696466.0.9319.885+2 more	High8.3	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: cross-site scripting Medium6.5Sep 8 CVE-2026-696426.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: spoofing High7.1Sep 8 CVE-2026-663056.0.9319.885+2 more	High7.1	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: information disclosure Medium6.5Sep 8 CVE-2026-663066.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: integer overflow High7.5Sep 8 CVE-2026-663076.0.9319.885+2 more	High7.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: out-of-bounds read Medium6.5Sep 8 CVE-2026-663086.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.