Windows UDFS Driver CVE-2026-40404

The attacker must already have local, interactive code execution on the target as at least a low-privileged authenticated user (CVSS PR:L) and must be able to cause the UDFS driver to parse attacker-controlled UDF on-disk metadata - in practice this means mounting a crafted ISO/IMG/UDF image or inserting a malicious optical disc, both of which a standard user can do by default on Windows. Once the malicious volume is presented to UDFS.sys, no further user interaction is needed (UI:N). Limiting factors: the bug is not remotely reachable over the network (AV:L), it requires the UDFS driver to be loaded and not disabled by policy, and it requires an existing foothold on the host - so it is realistically a post-compromise privilege escalation rather than an initial access vector.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) characterizes this as a local, low-complexity, low-privilege elevation of privilege with full impact on confidentiality, integrity, and availability - typical of a kernel pool corruption yielding SYSTEM. EPSS, KEV status, and SSVC data were not provided in the input, so exploitation probability cannot be quantitatively scored; the absence of a KEV entry and the lack of any public POC in the provided references suggest this is currently a patch-on-cycle item rather than an emergency. The local attack vector materially reduces real-world risk versus a remote RCE, but on multi-user systems, Terminal/RDP servers, kiosks, and lab/forensics workstations that routinely mount untrusted ISO or UDF media, this becomes a meaningful escalation primitive - particularly when chained from an initial-access RCE or phishing payload. UI:N means no user interaction is required once the malicious volume is presented to the driver, which matters because Windows auto-mounts attached optical media and double-clicked ISO files by default.

A standard-user attacker on a shared workstation crafts a malformed UDF-formatted ISO image (or burned optical disc) containing oversized file identifier descriptors that overflow a kernel heap allocation in UDFS.sys when the volume is mounted. They mount the image via the built-in Windows ISO mount handler - no admin rights or user interaction beyond a double-click are required - corrupt a kernel object, and pivot the primitive into SYSTEM token replacement to drop a persistent service or disable EDR. No public POC was identified in the references provided.