Windows UDFS CVE-2026-62699

Exploitation requires the attacker to be physically present at the target machine and able to insert removable storage media (USB drive, optical disc, or other UDF-capable device). The Windows UDFS.sys kernel driver must process the UDF volume, which occurs either automatically when AutoPlay is enabled (default on most consumer Windows configurations) or when a user or process browses the mounted drive. No authentication to the Windows OS is required - the overflow occurs at the driver level independent of logged-in sessions, per the CVSS PR:N metric. Exploitation is limited by: (1) mandatory physical presence and device access; (2) the target machine must have an accessible and functional USB or optical port - physical port blockers or BIOS-level drive disabling fully prevent exploitation; (3) if AutoPlay is disabled via Group Policy, an additional step of browsing the drive is required, though this is not a significant technical barrier for a physically-present attacker.

The CVSS 3.1 base score of 6.8 accurately reflects a tension between maximum impact (C:H/I:H/A:H - full kernel compromise) and severely constrained reach (AV:P - physical presence mandatory). Real-world risk is substantially lower than a comparable network-exploitable vulnerability: the attacker must be physically present with a prepared storage device, which eliminates remote and automated mass exploitation. No EPSS data was provided, but physical-vector vulnerabilities are historically underexploited at scale due to logistics. The absence from CISA KEV and lack of known POC further reduce urgency for most enterprise environments with solid physical security. However, risk is materially elevated for: kiosk systems, shared workstations, lab environments, field-deployed hardware, or insider-threat scenarios where physical access to an unattended machine is feasible. The scope of affected products - essentially every Windows deployment from 2012 onward - means the attack surface by host count is enormous even if the per-host exploitability is constrained.

An attacker with brief, unobserved physical access to a vulnerable Windows machine - such as an unattended workstation, a kiosk, or a server in an unlocked rack - inserts a USB drive formatted with a specially crafted UDF volume containing malformed structures designed to overflow the UDFS.sys heap. When Windows mounts the media (automatically via AutoPlay or manually when browsed), the kernel driver parses the malicious volume, the heap overflow occurs, and the attacker gains arbitrary code execution at kernel privilege. No public exploit code has been identified at time of analysis, but the attack requires no authentication and no user interaction beyond media insertion.