Microsoft Windows CVE-2026-50498

Exploitation requires the victim to mount or open an attacker-crafted UDF-formatted volume - an ISO, disc image, or optical medium that Windows parses with the UDFS driver - and that mount action is the UI:R user interaction the CVSS vector specifies. The attacker needs local delivery of the malicious media but no pre-existing privileges (PR:N), and impact stays confined to the local machine (AV:L, scope unchanged). Limiting factors: the attack cannot fire purely remotely without user cooperation, it does not trigger unless the crafted volume is actually mounted, and it applies only to the affected Windows/Server builds enumerated in the CPE list; environments that block mounting of untrusted disc images materially reduce exposure.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) describes a local, low-complexity attack requiring user interaction but no prior privileges, with high impact across all three security properties - a classic local privilege-escalation profile that pairs well with phishing or removable-media delivery. No EPSS score, SSVC decision, POC, or KEV entry was provided, so there is no evidence of active exploitation or automatable mass exploitation; this reads as a real but not emergency priority relative to network-facing RCE. Note the tension between the official 'Elevation of Privilege' title (and PR:N) and the 'Information Disclosure' tag plus CWE-125, which is an out-of-bounds READ that more naturally leaks kernel data than escalates - the practical impact primitive should be verified against Microsoft's MSRC advisory. Overall: patch on a normal prioritized cadence, but the near-universal Windows footprint raises aggregate exposure.

An attacker emails or hosts a specially crafted UDF-formatted ISO or disc image and lures a standard user into opening it; when Windows mounts the volume, the kernel UDFS driver parses malformed on-disk metadata, triggering the out-of-bounds read and enabling privilege escalation on the host. The local vector with required user interaction (AV:L/UI:R) makes this a plausible second-stage tool following phishing or low-privilege access. No public exploit identified at time of analysis.