Windows UDFS Driver EUVD-2026-100254

Exploitation requires the attacker to already possess local, authenticated access to the target Windows system (PR:L) and the ability to present malicious UDF-formatted data to the Universal Disk Format File System driver - for example by mounting a crafted optical-disc image (ISO/UDF), USB, or virtual volume that the UDFS driver parses. Limiting factors that reduce realistic risk: it is not remotely reachable (AV:L), it cannot be triggered by an unauthenticated user, impact is confined to information disclosure (no integrity or availability impact), and CISA SSVC assesses it as non-exploited and non-automatable. The affected component is present by default across all listed Windows versions, so no special non-default configuration is needed beyond the driver processing attacker-supplied UDF content.

This is a moderate-severity, low-priority issue despite being a Microsoft Windows kernel-mode driver flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack requiring an already-authenticated (PR:L) user, yielding high confidentiality impact but no integrity or availability impact - consistent with an out-of-bounds read (CWE-125) that leaks kernel/driver memory. All exploitation signals point the same direction and reinforce low real-world urgency: CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public proof-of-concept provided. No EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified here. In short, the signals are consistent rather than conflicting: a genuinely-reachable but local, authenticated, read-only information-disclosure bug. It is a patch-on-normal-cycle item, not a high-real-risk emergency, though its ubiquity (shipped in virtually all supported Windows versions) means it should still be remediated broadly because it is a useful building block for post-compromise memory disclosure (e.g., defeating KASLR or harvesting secrets).

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or code running after initial access) mounts or interacts with a crafted UDF-formatted volume - such as a malicious ISO/optical image or USB device - triggering an out-of-bounds read in the UDFS driver that returns adjacent kernel memory contents. No public exploit code is identified at time of analysis, and the local-only, authenticated nature means this serves as a privilege-escalation or memory-disclosure aid rather than an initial-access vector.