Windows exFAT EUVD-2026-100023

Exploitation requires the attacker to already hold local, authenticated low-privilege access to the target (PR:L, AV:L) and the ability to get the Windows exFAT driver to parse attacker-controlled filesystem data - in practice by mounting or accessing a crafted exFAT-formatted volume such as a removable USB device, mounted ISO/VHD, or disk image. No user interaction by a separate victim is needed (UI:N). The chief limiting factors are the need for a pre-existing local foothold and the ability to introduce or mount a malicious exFAT volume; there is no remote/network path. This affects default configurations wherever exFAT is used, which is standard on modern Windows; environments that block removable media and untrusted disk-image mounting meaningfully reduce the realistic attack surface.

This is a genuine but moderate-priority issue rather than an urgent fire-drill. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity, low-privilege elevation-of-privilege flaw with total confidentiality, integrity, and availability impact on the affected system - consistent with a kernel-mode heap overflow (CWE-122) in the exFAT file system driver. The signals align coherently and point toward LOWER real-world urgency than the HIGH base score alone suggests: CISA SSVC reports Exploitation=none, Automatable=no, Technical Impact=total, meaning no observed exploitation and no mass-automation potential, though full system compromise is possible once exploited. No CISA KEV listing and no public POC were provided (absence noted, not treated as proof), and no EPSS score was supplied, so exploitation probability cannot be quantified from this data. The requirement for prior local authenticated access (PR:L) is the dominant limiting factor - this is a privilege-escalation primitive useful to an attacker who already has a foothold, not a remote entry point. Net: patch on normal Patch Tuesday cadence, prioritizing multi-user and shared endpoints, but this is not a drop-everything emergency absent exploitation evidence.

A low-privileged local attacker (or malware running under a standard user account) crafts a malicious exFAT-formatted volume - for example on a USB stick or disk image - and induces the system to mount or parse it, triggering a heap buffer overflow in the Windows exFAT driver. By grooming the kernel heap and corrupting adjacent structures, the attacker gains SYSTEM-level code execution, escalating from standard user to full control. No public exploit code was identified at time of analysis, and local authenticated access is required (PR:L), so this would typically chain after an initial foothold.