Windows UDFS Driver CVE-2026-85825

Requires the attacker to already have local, authenticated low-privileged access to the Windows host (PR:L, AV:L) and the ability to drive the UDFS driver - typically by getting a crafted UDF-formatted volume (optical media or a mountable disc image) processed by the system. Exploitation is further limited by a race condition (AC:H): the attacker must repeatedly trigger concurrent UDFS operations to hit the narrow use-after-free timing window, so success is probabilistic rather than deterministic. No user interaction by a separate victim is required (UI:N). This is not remotely reachable and does not apply to default-configuration remote attack surface.

This is a genuinely moderate - not top-tier - priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms this is a LOCAL privilege-escalation flaw that requires the attacker to already have authenticated low-privilege access to the host and to win a timing-sensitive race window (AC:H), which materially lowers reliability and real-world exploitability compared to a network-reachable bug. CWE-362 (race condition) plus the 'Use after free' description is internally consistent and credible for an elevation-of-privilege primitive, with full C:H/I:H/A:H reflecting the kernel-level impact typical of a Windows file-system driver flaw. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is currently no signal of active or imminent exploitation - this reads as a high-impact-but-constrained issue rather than an urgent fire. One data conflict to flag explicitly: the input Tags include 'Denial Of Service', but both the description ('elevate privileges locally') and the CVSS impact set point to privilege escalation, not DoS - treat the DoS tag as suspect and verify against the Microsoft advisory. Overall: patch on a normal prioritized cadence; it is not a drop-everything item absent evidence of exploitation.

A local, authenticated low-privileged user on an affected Windows host triggers repeated UDFS file-system operations against a crafted UDF-formatted volume (e.g., a malicious disc image or mounted media), racing concurrent operations to hit the use-after-free window in the kernel driver. Successfully winning the race corrupts kernel memory and lets the attacker elevate to SYSTEM. No public exploit code was identified at time of analysis, and the AC:H race requirement makes reliable exploitation non-trivial.