One of our security researchers at Delphos Labs, Kamil Leoniak, triggered kernel memory corruption on Windows using a custom USB device and a user-mode stress PoC. Microsoft assigned CVE-2026-50321, classified it as a Windows USB Driver elevation of privilege, and shipped the fix on July 14. The bug is that the freed object reference stayed reachable long enough for another path to use it. WinUSB_FreePipe frees a pipe context and only nulls the shared pointer afterward. In that window the interface pipe array still points at freed memory, and device-control IOCTLs dispatch on a WDF parallel queue, so nothing serializes access to that array. 16 threads were enough. 12 calling pipe policy APIs, 4 toggling alternate settings. A policy call read the stale pointer and took a spinlock inside a freed 0xF0-byte NonPagedPool object. Without Special Pool that allocation stays mapped and reclaimable. With it, the machine bugchecks. Full writeup on the Delphos Labs blog, with the PoC on GitHub. https://delphoslabs.com/blog/cve-2026-50321-winusb-pipe-lifetime-race/?utm_source=twitter&utm_medium=social&utm_campaign=cve-2026-50321-blog-post&utm_content=caleb
Post summary
A user‑mode PoC demonstrated a Windows USB driver kernel memory corruption (CVE‑2026‑50321) that allows privilege escalation, with detailed technical explanation and PoC code on GitHub; Microsoft patched the issue on July 14.
