Windows UDFS CVE-2026-96946

Exploitation requires the attacker to already hold local, low-privileged execution on the target Windows system (PR:L, AV:L) and the ability to cause the UDFS driver to parse attacker-controlled UDF (Universal Disk Format) file-system data - typically by mounting or attaching a crafted UDF-formatted optical disc, ISO, or disk image. No user interaction by a victim is needed (UI:N) and attack complexity is low (AC:L), but the local-only vector means there is no remote or network-facing exposure: an attacker cannot reach this without a pre-existing foothold and the means to present a malicious UDF volume to the driver. This affects default configurations of all listed Windows 10/11 and Windows Server builds below the patched versions, since UDFS is a standard built-in component.

This is a CVSS 7.8 (High) local elevation-of-privilege flaw whose signals align consistently toward a moderate-but-real, not urgent, priority. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms it is locally exploitable by an already-authenticated low-privileged user with low complexity and no user interaction, and the S:U/C:H/I:H/A:H impact reflects full kernel-level compromise - corroborated by CISA SSVC 'Technical Impact: total'. However, SSVC also reports 'Exploitation: none' and 'Automatable: no', there is no CISA KEV listing, no public proof-of-concept is referenced, and no EPSS score was supplied. These signals jointly indicate a credible privilege-escalation primitive that requires a pre-existing foothold rather than a remotely-wormable, mass-exploited threat. One conflict to flag: the input Tags include 'Denial Of Service', yet the CVSS vector encodes full confidentiality and integrity impact (C:H/I:H) consistent with code execution, not merely availability loss - treat the DoS tag as incomplete labeling and prioritize this as an EoP/code-execution issue. EPSS is absent, so probabilistic exploitation likelihood cannot be quantified from the provided data.

An attacker who already has low-privileged access to a Windows host (e.g., a standard user or a process from a phishing/initial-access payload) supplies or mounts a maliciously crafted UDF-formatted volume or disk image, triggering the use-after-free in the UDFS driver. Because UDFS runs in the kernel, successful exploitation yields SYSTEM-level privileges, enabling full host takeover. No public exploit identified at time of analysis, and SSVC reports no observed exploitation.