CVE-2026-112984

MediumCVSS 6.6/10Last modified Nov 10, 2026

Description

Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1129857.5Integer overflow or wraparound in Microsoft JScript allows an unauthorized attacker to execute code over a network.CVE-2026-1129867.0No cwe for this issue in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-1129877.0Integer overflow or wraparound in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.CVE-2026-1129885.5Untrusted pointer dereference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-1129897.0Untrusted pointer dereference in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-112996.5Integer overflow in Fonts in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fromCVE-2026-1129904.7Buffer over-read in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.CVE-2026-1129916.3The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL vCVE-2026-1129929.6Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HCVE-2026-1129938.8Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass webCVE-2026-1129948.8UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI CVE-2026-1129958.8Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a
CVE-2026-112984: Medium severity, CVSS 6.6 | Vulnix