The Security Bulletin states that the "Maximum Security Impact" is "Elevation of Privilege"; however, the SRD blog post says code execution is possible. Additionally, SRD says "Other software that enables low-level pass-through of USB device enumeration may open additional avenues of exploitation that do not require direct physical access to the system". Further, the March Summary indicates that an exploit is likely for this vulnerability. Given all of this, how is the "Aggregate Severity Rating" not Critical? Once scenario that I'm now worried about is the maid walking around at night, owning all of the desktops on my trading floor, or any other Windows based corporate device.
EDIT: Here is the white paper the researcher published on the topic of USB.