Windows UDFS Driver CVE-2026-83713

Exploitation requires the attacker to already have local, authenticated (low-privilege) access to the target Windows host, consistent with AV:L/PR:L. The concrete trigger is the UDFS (Universal Disk Format) filesystem parser processing a maliciously crafted UDF volume - e.g. a rogue optical disc, ISO/UDF disk image, or removable USB/mounted device - so the practical prerequisite is the attacker's ability to introduce and have that UDF volume mounted/parsed. Limiting factors that reduce real-world risk: no remote vector (local only), an existing authenticated session is needed, no user interaction by a victim is required (UI:N) but the attacker must supply and mount the crafted media, and the impact is confined to information disclosure (no integrity or availability loss). Affected systems are only those below the fixed build numbers listed in the EUVD data.

This is a genuinely moderate, low-urgency issue rather than a top-tier priority. The signals are consistent and mutually reinforcing: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local attack requiring an already-authenticated low-privilege user, with impact limited to confidentiality (C:H/I:N/A:N) - an information disclosure, not code execution. CISA's SSVC framework agrees, scoring Exploitation=none, Automatable=no, and Technical Impact=partial, which maps to a 'Track' (monitor) rather than 'Act' decision. No CISA KEV listing and no public exploit were provided, and no EPSS score was supplied in the input. There are no conflicting signals here - every source points the same direction (local, authenticated, confidentiality-only, not exploited). The only minor nuance is that Microsoft rated confidentiality as High (C:H); for an out-of-bounds read in a filesystem driver this typically reflects potential kernel-memory disclosure, but the volume/predictability of leaked data is not quantified in the available data. No key data is missing in a way that changes the conclusion; EPSS is simply absent and should not be inferred.

A local, authenticated user mounts a specially crafted UDF-formatted volume (for example a malicious ISO/disc image or USB device), causing the Windows UDFS driver to read beyond an allocated buffer and return adjacent kernel or uninitialized memory contents to the attacker. This could leak sensitive data such as memory addresses useful for defeating ASLR or fragments of other processes' data. No public proof-of-concept or active exploitation was identified in the provided data, and the local, low-complexity vector means a working exploit is plausible but must be delivered by a user who already has a foothold on the machine.