Windows UDFS Driver CVE-2026-96947

Exploitation requires the attacker to already have authenticated local code execution on the Windows host (PR:L) and the ability to drive the UDFS driver into parsing a crafted Universal Disk Format volume - typically by mounting a malicious UDF/ISO/DVD image or interacting with a UDF-formatted device, which is the standard code path for this driver present in default Windows installations. No user interaction by a separate victim is needed (UI:N) and attack complexity is low (AC:L). The key limiting factor is the local attack vector: there is no network-exploitable path, so this cannot be used for initial access and is only valuable as a post-compromise privilege-escalation step; it affects the Windows versions below the fixed builds enumerated in the EUVD data.

This is a genuine patch-priority issue for Windows environments, but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) describes a use-after-free (CWE-416) in the Universal Disk Format File System driver (UDFS) that an already-authenticated local user can trigger with low complexity and no user interaction to gain full SYSTEM-level privileges (C:H/I:H/A:H), scored 7.8/HIGH. The limiting factor is the local attack vector and the PR:L requirement: the attacker must already be able to execute code on the host, so this is a post-compromise privilege-escalation primitive rather than an initial-access remote exploit. No EPSS score, SSVC decision data, or POC indicator was provided in the input, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - treat it as a high-value local EoP that should be patched on a normal urgent cycle. No conflicting signals: the CVSS vector (local) is fully consistent with the description ('elevate privileges locally'). The main missing data is exploitation likelihood (no EPSS) and POC availability - neither confirmed nor denied by the input.

A local attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a standard user account, or a compromised service) mounts or interacts with a crafted UDF-formatted volume - such as a malicious ISO/DVD image - to trigger the use-after-free in the UDFS driver. By grooming the freed kernel object and reclaiming it with attacker-controlled data, the attacker corrupts kernel memory and elevates to SYSTEM. No public exploit code was identified in the provided intelligence.