# CVE-2026-32223 — Windows USB Printer Driver `usbprint.sys` Heap Buffer Overflow

---

## Summary

| **Product** | Microsoft Windows — `usbprint.sys` (USB Printer Driver) |
|---|---|
| **Vendor** | Microsoft Corporation |
| **Severity** | CVSS v3.1 **7.8 (High)** |
| **CVE Title** | Windows USB Printer Driver Elevation of Privilege Vulnerability |
| **CWE** | CWE-122 (Heap-based Buffer Overflow) |
| **Affected Versions** | Windows 10/11 with USB printer support |
| **Impact** | Local EoP — low-privilege user with USB access → SYSTEM |
| **Exploited ITW** | No |
| **Patch Date** | 2026 (exact KB pending) |
| **Public analysis** | [ENKI — Plug Me If You Can](https://www.enki.co.kr/en/media-center/blog/plug-me-if-you-can-exploiting-usb-printer-drivers-in-windows) |

---

## Root Cause

Windows USB printer driver (`usbprint.sys`) processes IOCTL `0x220064` which
requests a 1284-compatible ID string from the printer's USB string descriptors.
The function `Make1284IdStringFromUsbStrings` constructs this string by
concatenating the **MFG** (manufacturer) and **MDL** (model) USB string
descriptors:

```c
// Simplified vulnerable path
MFG_len = strlen(MFG_string);
MDL_len = strlen(MDL_string);
copy_size = MFG_len + MDL_len + 11;   // 11 bytes for "MFG:" + "MDL:" + separators

RtlStringCbPrintfA(dest_buffer, OutputBufferLength, "MFG:%s;MDL:%s;", MFG, MDL);
```

The destination buffer size is `OutputBufferLength` from the IOCTL request.
However, `copy_size` (the actual bytes written) can exceed
`OutputBufferLength` when MFG + MDL strings are long. The `RtlStringCbPrintfA`
call truncates based on `OutputBufferLength`, but subsequent operations or
intermediate copies may not be properly bounded — leading to a **heap buffer
overflow**.

The ENKI writeup describes exploitation using **named-pipe pool feng shui** to
corrupt `POOL_HEADER` and create a **ghost chunk** for arbitrary read/write in
`NonPagedPoolNx`.

### The patch (verified in ghidriff diff — usbprint.sys 10.0.26100.7920 → 10.0.26100.8246)

- **Modified: `Make1284IdStringFromUsbStrings`** (91 % match) — string
  construction path is now gated behind a feature flag.
- **Added:**
  - `Feature_64687419__private_IsEnabledDeviceUsageNoInline`
  - `Feature_64687419__private_IsEnabledFallback`
- When `Feature_64687419` is enabled, `Make1284IdStringFromUsbStrings` validates
  MFG / MDL string lengths against the output buffer size **before** calling
  `RtlStringCbPrintfA`. If the combined string would exceed the buffer, the
  function fails safely instead of truncating or overflowing.

---

## Reaching the bug — local attack

Requires physical USB access or USB redirection (RDP/VM):

```
Attacker-controlled USB device (or virtual USB via RDP redirection)
    │
    ▼
USB descriptors: MFG = "A"×N, MDL = "B"×N  (long strings)
    │
    ▼
Windows enumerates printer → loads usbprint.sys
    │
    ▼
user process opens \\?\\USB#VID_...&PID_...\\...
    │
    ▼
DeviceIoControl(IOCTL 0x220064, OutputBufferLength = small)
    │
    ▼
usbprint!USBPRINT_ProcessIOCTL
    │
    ▼
usbprint!Make1284IdStringFromUsbStrings
    │   MFG_len + MDL_len + 11 > OutputBufferLength
    ▼
heap overflow in NonPagedPoolNx
```

| Element | Value |
|---|---|
| Device path | `\Device\USBPDO-...` (printer interface) |
| IOCTL | `0x220064` |
| Vulnerable functions | `usbprint!USBPRINT_ProcessIOCTL`, `usbprint!Make1284IdStringFromUsbStrings` |
| Allocation | NonPagedPoolNx (via USB driver stack) |
| Privileges | Physical USB access or USB redirection; no software privilege needed |
| Prerequisites | USB printer device (real or emulated) connected to target |

---

## Detection engineering

- **USB device control**: Restrict USB printer devices via Device Guard / CSP
  policies in high-security environments.
- **ETW**: `Microsoft-Windows-USB-USBPORT` and `Microsoft-Windows-USB-USBHUB`
  providers may log abnormal USB descriptor lengths.
- **Crash forensics**: Heap corruption bugcheck in `usbprint!Make1284IdStringFromUsbStrings`
  with long MFG/MDL strings in the USB descriptor cache.
- **Behavioral tell**: Non-printer software opening USB printer devices and
  issuing IOCTL `0x220064` is anomalous.

## References

- [MSRC — CVE-2026-32223](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32223)
- [ENKI — Plug Me If You Can](https://www.enki.co.kr/en/media-center/blog/plug-me-if-you-can-exploiting-usb-printer-drivers-in-windows)