CVE-2026-32223: Plug me If you can : Exploiting USB Printer Drivers in Windows

Heap-based buffer overflow in Windows USB Print Driver (usbprint.sys) leading to Local Privilege Escalation (LPE)

This vulnerability was discovered and reported by ENKI WhiteHat.

Overview

CVE-2026-32223 is a heap-based buffer overflow vulnerability in the Windows USB print driver (usbprint.sys). The vulnerability is caused by improper validation of USB string descriptors during the processing of IOCTL 0x220064 in the Make1284IdStringFromUsbStrings function.

When a specially crafted USB printer device is connected and a userland program invokes the vulnerable IOCTL, the driver copies data from the USB device's MFG/MDL string descriptors into a heap buffer without properly validating the relationship between the source data size and the destination buffer size, resulting in a NonPagedPoolNx heap overflow.

The full exploitation chain achieves SYSTEM privilege escalation through:

• USB device emulation with malformed descriptors (via Linux Raw Gadget on Odroid C4)
• Pool Feng Shui with Named Pipe spray for heap layout control
• Ghost Chunk technique for pool overlap and kernel address leak
• Arbitrary read/write primitives via forged IRP structures
• SeDebugPrivilege LUID modification for privilege escalation

Demo

Blog Post

The full technical writeup is available on the ENKI WhiteHat Blog.

Disclaimer

This repository is provided strictly for security research and educational purposes only.

• Do NOT use the contents of this repository for any unauthorized or malicious activities.
• The authors are not responsible for any misuse or damage caused by the use of this code.