Windows UDFS Driver EUVD-2026-100016

Requires local, authenticated access as a low-privileged user (AV:L/PR:L) - this is not remotely exploitable. The specific prerequisite is that the attacker gets the Windows UDFS (Universal Disk Format) file system driver to parse attacker-controlled UDF-formatted data, typically by mounting or accessing a crafted UDF volume such as a malicious ISO/optical-disc or disk image, which triggers the use-after-free during filesystem parsing. Limiting factors: the attacker must already have code execution/login on the target, no network path exists, and the flaw is useful primarily as a post-compromise local-to-SYSTEM escalation rather than an initial-access vector; no user interaction by a separate victim is required (UI:N).

This is a locally-exploitable elevation-of-privilege flaw in the Windows UDFS kernel driver, rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact (SSVC Technical Impact: total). The signals are consistent and point to a genuine but second-tier priority rather than an emergency: the CVSS attack vector is Local (AV:L) and requires an already-authenticated low-privileged user (PR:L), so there is no remote mass-exploitation path. CISA SSVC lists Exploitation as 'none' and Automatable as 'no', and there is no EPSS score, no CISA KEV listing, and no public exploit code supplied in the input - so there is no public exploit identified at time of analysis. The one cross-source tension is a classification discrepancy: the description states 'use after free' while the assigned CWE is CWE-121 (stack-based buffer overflow) and the tags add 'Buffer Overflow'/'Stack Overflow'/'Denial Of Service' - verify the true root cause with Microsoft, though it does not change the EoP risk profile. Net: patch on normal cadence as a reliable local-to-SYSTEM primitive (valuable in post-compromise chains), but it is not a drop-everything network threat.

An attacker who already has a low-privileged foothold on a Windows host (via phishing, stolen credentials, or a sandboxed process) supplies or mounts a maliciously crafted UDF-formatted volume - such as a rogue ISO/optical disc image - causing the UDFS driver to reuse freed memory. Because the attack vector is Local with low complexity and no user interaction (AV:L/AC:L/UI:N), the attacker reliably triggers the flaw to execute code in kernel context and elevate to SYSTEM. No public proof-of-concept was identified at time of analysis.