Windows UDFS CVE-2026-96949

Requires the attacker to already hold a valid low-privileged local account or local code-execution capability on the target Windows host (PR:L, AV:L) - this is not remotely reachable. Exploitation specifically targets the Universal Disk Format File System Driver (UDFS), so the attacker must drive UDFS code paths, typically by presenting or mounting a malicious UDF-formatted volume/disk image and triggering concurrent operations against it. The principal limiting factor is the race condition (AC:H): the attacker must reliably win a narrow timing window to turn the use-after-free into a controllable primitive, which lowers real-world reliability. No user interaction is required (UI:N), and the flaw is present in default configurations of affected Windows versions since UDFS is a built-in OS component.

This is a moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes an authenticated local attacker who must win a race condition (CWE-362, use-after-free) to achieve full confidentiality, integrity, and availability impact on the host. AC:H is the dominant risk-limiting signal: successful exploitation requires reliably winning a timing window in the UDFS driver, which raises engineering effort and reduces reliability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of widespread or active exploitation - the signals are consistent with a not-yet-exploited local EoP rather than a mass-exploited flaw. Note a labeling conflict: the Tags include 'Denial Of Service' while the description and CVSS (C:H/I:H/A:H, EoP) describe privilege elevation, not just DoS; a UAF plausibly supports both outcomes, but the authoritative description frames this as local EoP. Because PR:L requires the attacker to already have a foothold (valid low-privileged account/local code execution), real-world priority is highest on multi-user, shared, or kiosk Windows systems where untrusted users have local access.

A local attacker with low-privileged access runs crafted code that interacts with the UDFS driver (e.g., mounting or manipulating a malicious UDF-formatted disk/image) and repeatedly triggers concurrent operations to win a race that leaves a freed object in use. By grooming the freed allocation, they reuse the dangling pointer to corrupt kernel memory and elevate to SYSTEM. No public exploit code was identified at time of analysis, and the high attack complexity (race window) makes reliable exploitation non-trivial.