Windows UDFS Driver CVE-2026-85821

Requires local, authenticated access (PR:L): the attacker must cause the Windows UDFS (Universal Disk Format) file-system driver to mount and parse a maliciously crafted UDF volume - typically a rigged optical-disc/ISO image or virtual/removable disk - which triggers the out-of-bounds read. Limiting factors: exploitation is bounded to confidentiality (memory disclosure only, no code execution or tampering), demands valid local credentials and the ability to present an attacker-controlled UDF volume to the driver, and affects only unpatched builds in the listed ranges. Note: the input CVSS vector claims AV:N, but the description's 'locally' and the file-system-parsing nature indicate local reachability - defenders should treat required access as local, not network.

Signals are consistently moderate-to-low for real-world urgency despite the CVSS 6.5 (MEDIUM) rating. The SSVC framework is the clearest signal: Exploitation=none, Automatable=no, Technical Impact=partial - pointing to Track/low-priority rather than Act. There is no EPSS score in the input, no CISA KEV listing, and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' The most important caveat is a vector/description conflict: the provided CVSS vector is AV:N (network) with UI:N, yet the description explicitly says 'disclose information locally' and CWE-125 in a file-system driver (UDFS) realistically requires the driver to parse an attacker-supplied UDF volume (e.g., a mounted disc/ISO image) - a local operation. This AV:N label is almost certainly an artifact of Microsoft's scoring convention and overstates reachability; treat this as a local, authenticated (PR:L) information-disclosure bug, not a remote one - verify with the MSRC advisory. Impact is limited to confidentiality (C:H, I:N, A:N) with no code execution, no integrity or availability loss. Net: a real but low-priority issue - patch in normal cycle; not an emergency absent evidence of active exploitation.

An authenticated local user (or malware already running with user privileges) crafts a malformed UDF file-system image and induces the Windows UDFS driver to mount/parse it, triggering an out-of-bounds read that leaks adjacent kernel or driver memory back to the attacker. No public exploit code is identified at the time of analysis, and the low attack complexity (AC:L) means a reliable trigger is plausible once the malformed volume is parsed, but the attacker must already have local access.