Windows UDFS Driver EUVD-2026-100048

Requires local, authenticated access (PR:L) to a Windows system and the ability to make the Universal Disk Format File System (UDFS) driver parse an attacker-controlled UDF-formatted volume - e.g. a crafted ISO/optical-disc image, UDF-formatted removable media, or a mountable disk image. There is no remote vector (AV:L) and no user interaction by a separate victim is modeled (UI:N); the attacker themselves must trigger the parse. Exploitation is limited to information disclosure (C:H, I:N, A:N) with no code execution or system modification, and SSVC rates it non-automatable, so it cannot be mass-exploited. The main limiting factors are the local-access and low-privilege prerequisites plus the need to get the UDFS driver to process malicious input.

This is a moderate-severity, low-urgency issue by all available signals, and they are consistent with one another. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 5.5) describes a local, low-complexity attack requiring low privileges, with high confidentiality impact but no integrity or availability impact - i.e. pure information disclosure, not code execution. CISA SSVC reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably mass-exploited), Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The one notable tension is the 'Buffer Overflow' tag versus the actual weakness: the description and CWE-822 (untrusted pointer dereference) describe an out-of-bounds READ causing information disclosure, not a classic overflow with write/code-execution potential - treat the tag as approximate, not as evidence of RCE. Overall this is a genuine but low-priority defect: local-only access requirement and info-disclosure-only impact place it well below internet-facing or wormable flaws, despite the C:H rating.

A local, low-privileged attacker on a Windows host presents the UDFS driver with a maliciously crafted UDF file-system image (for example a booby-trapped optical disc image, ISO, or removable-media volume) and induces the system to parse it. The out-of-bounds read causes the driver to return adjacent kernel/driver memory contents, leaking potentially sensitive data such as pointers or secrets to the attacker. No public exploit code has been identified at the time of analysis.