Windows UDFS Driver EUVD-2026-43805

Exploitation requires the attacker to already possess local, authenticated access to the target (CVSS PR:L) and the ability to get the UDFS driver to parse an attacker-controlled UDF-formatted volume - i.e., mounting or inserting a crafted optical disc, USB/removable device, or UDF disk image so udfs.sys processes its on-disk structures. No user interaction by a victim is needed (UI:N) and complexity is low (AC:L), but the attack is strictly local (AV:L) and cannot be performed remotely or against a default configuration without first obtaining an interactive/low-privilege foothold. Limiting factors: the target must actually mount/parse the malicious UDF media, so environments that block untrusted removable media or disallow arbitrary image mounting significantly reduce exposure; the flaw does not cross a scope boundary (S:U) and yields elevation on the local host only.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes a local, low-complexity, low-privilege attack with no user interaction and total confidentiality/integrity/availability impact but no scope change - a classic local elevation-of-privilege profile, not a remote entry point. This is corroborated by CISA SSVC: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (an attacker cannot mass-scan-and-exploit this at scale because it requires local code execution first), and Technical Impact 'total'. EPSS is low at 0.31% (23rd percentile), consistent with a not-actively-exploited local bug that requires a foothold. Signals are mutually consistent rather than conflicting: high severity per CVSS is driven by impact, not reachability. Net: this is a real but second-stage risk - valuable to an attacker who already has a foothold or as part of a chain, and it should be patched on the normal Patch-Tuesday cadence, prioritizing multi-user, kiosk, and shared-workstation systems over single-user isolated hosts.

An attacker who already has a low-privileged foothold - a standard domain user, a compromised service account, or a malicious insider on a shared workstation - supplies a specially crafted UDF-formatted volume (an inserted disc, a USB device, or a mounted disk image) that the udfs.sys driver parses. The malformed length/offset field triggers the integer underflow in kernel context, corrupting memory to escalate from the low-privileged account to SYSTEM. No public exploit is identified at time of analysis, but the low attack complexity and no-user-interaction profile make it an attractive local privilege-escalation primitive for post-compromise chaining.