EUVD-2026-35655
GHSA-gh84-vhg8-4mc3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local user access
-
DeliveryStage crafted UDF/ISO image on host
-
ExploitTrigger UDFS.sys parsing via mount
-
ExecutionExploit numeric truncation in kernel parser
-
PersistCorrupt kernel memory for SYSTEM token
-
ImpactExecute payload as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Numeric truncation prevention
|
| Exploitation Conditions | Attacker must already have authenticated local code execution as a low-privileged user on the target Windows host (CVSS PR:L, AV:L), and must be able to cause the UDFS driver to parse attacker-controlled UDF file-system metadata - typically by mounting a crafted ISO, optical disc, or virtual disk volume. No user interaction by another principal is required (UI:N), but the attack is constrained to local execution: it cannot be triggered over the network without a separate initial-access vector. Environments that block ISO/UDF mounting for non-administrative users, or that disallow attachment of removable/virtual media, materially limit exploitability. |
| Impact | The CVSS vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity attack requiring only an authenticated user, with no user interaction, yielding full CIA impact - consistent with a local-to-SYSTEM elevation of privilege primitive. EPSS, KEV, and POC signals were not supplied in the intelligence package, so exploitation likelihood and weaponization status are unknown at time of analysis. Note a tagging inconsistency: the input lists 'Information Disclosure' as a tag, but the description and CVSS impact metrics describe an Elevation of Privilege class - defenders should treat this as EoP per the Microsoft title and CVSS impact set rather than the tag. UDFS exploitation typically requires the attacker to convince the system to mount a crafted UDF volume (optical disc, ISO, or attached storage), which is a meaningful but not prohibitive precondition in interactive workstation scenarios. |
| Exploit ScenarioDerived | A standard domain user on a patched-but-vulnerable Windows endpoint mounts a maliciously crafted UDF-formatted ISO image (delivered via download, USB, or attached storage), triggering the truncation flaw inside UDFS.sys during volume parsing and corrupting kernel memory. The attacker leverages the corruption to elevate from a low-privileged user to SYSTEM, then disables endpoint protections and stages follow-on tooling. No public exploit identified at time of analysis, but local EoP primitives in Windows file-system drivers are routinely incorporated into post-compromise toolkits. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Elevation of privilege in the Microsoft Windows Universal Disk Format File System (UDFS) driver allows a local authenticated attacker to escalate to SYSTEM-level privileges with high impact on confidentiality, integrity, and availability. The CVSS 7.8 vector indicates local attack with low complexity and low privileges required, and no public exploit identified at time of analysis. The vulnerability stems from a numeric truncation error (CWE-197) in kernel-mode file system code, a class historically favored by post-compromise privilege escalation chains.
RemediationAI
Apply the Microsoft security update referenced in MSRC advisory CVE-2026-40409 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40409 as the primary remediation; the exact fix KB and build numbers must be obtained from that advisory because they were not provided in this intelligence package, so cite 'Patch available per vendor advisory' until the specific KB is confirmed. Until patching is complete, reduce exposure by restricting which users can mount removable or virtual media: disable optical drive auto-mount via Group Policy, block ISO/IMG/UDF image mounting where not required for business workflow, and use AppLocker or WDAC to constrain who can attach virtual disks (side effect: legitimate users who routinely mount ISOs for installation media will be impacted). Enforce least privilege on interactive accounts so that even successful EoP yields lower-value lateral movement targets, and monitor for unexpected UDFS-related kernel events or bugchecks that may indicate exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 33 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UDFS.sys is the Windows kernel-mode driver implementing the Universal Disk Format (ISO/IEC 13346 / ECMA-167) file system used primarily for optical media (DVD, Blu-ray) and certain virtual disk images. Because the driver parses structured on-disk metadata in kernel context, parsing flaws translate directly into ring-0 corruption. CWE-197 (Numeric Truncation Error) indicates that a larger integer value is converted into a smaller type, losing significant bits - in a file system driver this typically results in undersized buffer allocations, miscalculated record lengths, or bypassed bounds checks when oversized UDF descriptors, partition maps, or file entries are parsed. The CPE strings were not provided in the input, but Microsoft's MSRC advisory URL is the authoritative source for the exact affected Windows SKUs and builds.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Executive ViewAI
A privilege escalation vulnerability in Microsoft Windows UDFS driver (CVE-2026-40409) allows authenticated local users to escalate to SYSTEM-level access, creating risk of complete system compromise including unauthorized data access and malware installation. Organizations must secure systems where low-privilege user accounts have local access, as this vulnerability enables attackers already on the network to bypass administrative protections and achieve full system control.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable UDFS driver via registry if not required; (2) Restrict local user logon and group membership via Security Policy; (3) Enable Windows Driver Verifier for kernel-mode integrity monitoring; (4) Deploy EDR to alert on SYSTEM-level privilege escalation; (5) Implement audit logging for sensitive privilege use and process creation; (6) Enforce least-privilege access controls on local accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Windows UDFS Driver Elevation of Privilege
View all 2More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB