EUVD-2026-43805
GHSA-57xg-jwr6-j98c
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local, low-privilege attacker parses crafted UDF media with no user interaction (AV:L/PR:L/UI:N/AC:L); kernel-mode integer underflow yields full SYSTEM compromise (C:H/I:H/A:H) without scope change.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
AnalysisAI
Local privilege escalation in the Microsoft Windows Universal Disk Format File System driver (udfs.sys) lets an authenticated low-privileged user gain SYSTEM-level control by triggering an integer underflow (CWE-191) while parsing a malicious UDF-formatted volume. It affects a broad Windows footprint from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Currently there is no public exploit identified at time of analysis, EPSS is low (0.31%), and CISA SSVC rates exploitation as none, though the technical impact is total.
Technical ContextAI
UDFS is the Windows kernel-mode driver (udfs.sys) that implements the Universal Disk Format (ISO/IEC 13346 / ECMA-167) file system, the standard used for DVDs, Blu-ray discs, and packet-written optical/removable media. Because it runs in ring 0, any memory-safety defect in its parsing logic translates directly into kernel compromise. The flagged weakness is CWE-191 (Integer Underflow / Wrap-around); the vendor tags also reference Integer Overflow and Information Disclosure, indicating a length or offset field in the UDF on-disk structures underflows during parsing, producing an out-of-bounds condition the driver then acts upon. The affected CPEs span every currently supported client and server SKU (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations), confirming the flaw lives in shared, long-lived filesystem code rather than a single edition.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises udfs.sys to at least the fixed build for your SKU (for example 10.0.26100.8875 for Windows 11 24H2, 10.0.19045.7548 for Windows 10 22H2, 6.3.9600.23291 for Server 2012 R2, 10.0.20348.5386 for Server 2022, 10.0.26100.33158 for Server 2025) as listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49790 - this is the definitive remediation. Where immediate patching is not possible, compensating controls target the attack surface: restrict the ability of untrusted users to mount arbitrary removable/optical media or UDF-formatted disk images, since exploitation requires the driver to parse attacker-controlled UDF structures; on servers and hardened endpoints that never use optical/UDF media you can disable or block automatic mounting of removable volumes via Group Policy (trade-off: breaks legitimate DVD/Blu-ray and UDF image workflows). Because this is a local EoP, also enforce least privilege and limit interactive logon on shared and multi-user systems to reduce who can stage the attack. Do not rely on network controls - the attack vector is local, not remote.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-191 – Integer Underflow
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today