Windows UDFS Driver EUVD-2026-73546

Exploitation requires an existing foothold on the target machine with at minimum a standard (low-privileged) local or domain user account - PR:L per the CVSS vector. The attacker must be able to trigger UDF filesystem parsing, which can be achieved by mounting a crafted UDF-formatted volume (optical disc image, ISO, removable storage) accessible to a standard user. No user interaction from a third party is required once the attacker can trigger the parse operation. Exploitation is limited to local access; remote unauthenticated exploitation is not possible. Systems where standard users cannot mount removable media or optical drives (controlled via group policy) reduce but may not eliminate exposure, as other code paths may invoke the UDFS driver.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) accurately reflects a serious but locally-constrained privilege escalation: an attacker already on the machine with a standard user account can reliably achieve SYSTEM access with low complexity and no user interaction, making this a highly effective post-exploitation step. The local attack vector (AV:L) limits the exposure compared to remote vulnerabilities, but LPE flaws are routinely chained with initial-access exploits - even a mid-sized municipal IT team in swidnica should treat this as urgent patching for any internet-exposed or multi-user Windows systems. No CISA KEV listing or public PoC has been identified at time of analysis, and the EPSS score is not provided, so there is no confirmed active exploitation signal; however, heap overflow LPE primitives in Windows kernel drivers have historically attracted rapid weaponization once a patch is released (patch-diffing). The extraordinarily wide affected-version footprint - covering every major Windows Server and desktop release from 2012 through 2025 - amplifies organizational exposure: unpatched endpoints across this range are all vulnerable. The SSVC technical impact is rated 'total' given full C/I/A compromise upon successful exploitation.

An attacker who has obtained a low-privileged shell on a Windows system (via phishing, web vulnerability, or other initial access) creates or mounts a specially crafted UDF filesystem image designed to trigger the heap overflow in udfs.sys. The overflowed kernel heap memory corrupts adjacent data structures, allowing the attacker to redirect execution flow and achieve SYSTEM-level code execution, gaining full control over the host. No public exploit code has been identified, but patch diffing of the released cumulative update could reveal the exact overflow condition.