Windows UDFS Driver CVE-2026-96950

Requires local access with at least low-privilege execution on the target (PR:L, AV:L) and the ability to make the Universal Disk Format File System driver (UDFS.sys) parse attacker-controlled UDF data - typically by mounting a crafted UDF-formatted optical disc, ISO, VHD, or removable volume/image, which forces the vulnerable file-system parser to process malicious structures. Limiting factors: the attacker must already be authenticated on the machine and able to trigger UDF mounting/parsing; there is no remote or unauthenticated path and no automatic drive-by vector from the network. Affects default configurations of all listed supported Windows 10/11 and Windows Server builds below the patched versions, since UDFS is a standard OS component.

This is a credible but not emergency-level priority. The CVSS 3.1 base score of 7.8 (High) is driven by full CIA impact (C:H/I:H/A:H) with low attack complexity, but the vector is explicitly local (AV:L) and requires existing low-level privileges (PR:L) - it is a privilege-escalation primitive, not a remote-compromise vector. There is no EPSS score in the input, no CISA KEV listing, and no public POC indicated, so exploitation probability signals are absent rather than elevated; per the precision rules this means 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The one tension in the data is the 'Denial Of Service' tag, which conflicts with the description's stated impact of local privilege elevation - a CWE-416 use-after-free can plausibly manifest as both a crash (DoS) and a code-execution/EoP condition, so this is not necessarily an error, but the authoritative description and CVSS both point to EoP as the primary outcome. Overall: a real patch-worthy issue for any multi-user or defense-in-depth Windows environment, but lower urgency than a network-reachable or unauthenticated flaw, and best treated as a second-stage escalation risk rather than an initial access vector.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing, a standard user account, or a prior foothold) triggers the UDFS driver by causing a crafted UDF-formatted volume or disk image to be parsed/mounted, driving a use-after-free in kernel memory. By grooming the freed object, they achieve arbitrary kernel-mode read/write and escalate to SYSTEM. No public exploit code is identified in the provided data, so weaponization effort would currently fall on the attacker.