Windows UDFS Driver EUVD-2026-100275

Exploitation requires the attacker to already hold local, authenticated access with at least low privileges (PR:L) on the target host - there is no remote or unauthenticated path (AV:L). The specific trigger is the Windows UDFS (Universal Disk Format) file system driver parsing a malformed UDF structure, meaning the attacker must get a crafted UDF-formatted volume mounted or read - e.g. a malicious optical disc or a UDF/ISO image file that the system parses. Limiting factors: physical or interactive local presence (or an existing foothold) is mandatory, so blast radius is confined to hosts where untrusted users or code can execute; no user interaction by a victim is needed (UI:N), and all supported Windows versions ship the UDFS driver, so there is no non-default-configuration barrier beyond getting the malformed volume parsed.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a local privilege-escalation / code-execution flaw: the attacker must already have local, authenticated access with low privileges, but once present the attack is low-complexity, needs no user interaction, and yields high confidentiality, integrity, and availability impact - consistent with gaining SYSTEM-level code execution from a standard user. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or available weaponization - exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent except for one tension: the description and CWE-476 (null pointer dereference) plus the 'Denial Of Service' tag point toward a crash/DoS primitive, whereas Microsoft's 'execute code locally' wording and the C:H/I:H/A:H impact imply full local code execution - null-pointer dereferences in a kernel-mode driver can sometimes be groomed into code execution, so treat the code-execution rating as the vendor's assessment rather than independently confirmed. Because this is a local-only EoP in a ubiquitous OS component, prioritize patching on multi-user hosts and any system where untrusted users or malware could run, but it is not a remotely-wormable crisis.

An attacker who already has a low-privileged local account (or whose malware is running as a standard user) crafts a malformed UDF filesystem image and induces it to be mounted/parsed - for example by inserting optical media or mounting a specially crafted ISO/UDF image. The UDFS kernel driver dereferences a null pointer while parsing the structure, which the vendor states can be leveraged to execute code locally and escalate to SYSTEM. No public exploit code was identified in the provided data.