Windows UDFS CVE-2026-102218

Exploitation requires the attacker to already possess local, authenticated, low-privileged execution on the target (PR:L) and the ability to get the Windows Universal Disk Format File System Driver (UDFS) to parse attacker-controlled UDF-formatted data - for example, a crafted ISO image or UDF optical/removable volume that is mounted or opened. No user interaction by a separate victim is needed (UI:N). The key limiting factors are the prerequisite local foothold and the need to deliver a malformed UDF volume to the parser; this cannot be reached remotely or without prior access, which substantially narrows realistic exploitation to post-compromise privilege escalation.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already have authenticated, low-privileged code execution on the target before the heap overflow (CWE-122) can be triggered, which rules out remote or unauthenticated use. All three impact metrics are High, consistent with a kernel-mode driver bug that typically yields SYSTEM-level code execution. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no positive signal of active exploitation or weaponization - no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (local vector, requires prior access, high technical impact) with no contradictions to flag. In practice, LPE bugs like this are second-stage tools used after an initial foothold, so prioritize patching on multi-user hosts and endpoints where untrusted users can run code, but it does not warrant the same urgency as a remotely exploitable flaw.

An attacker who has already gained low-privileged code execution on a Windows machine supplies a maliciously crafted UDF-formatted volume (e.g., an ISO image or optical/removable media) that the UDFS driver parses, triggering the heap-based buffer overflow in kernel mode. Successful exploitation elevates the attacker from a standard user to SYSTEM. No public exploit code was identified in the provided data.