Windows exFAT Driver EUVD-2026-73566

Requires the vulnerable Windows exFAT file-system driver to parse attacker-controlled exFAT-formatted data - typically a crafted removable volume, disk image, or mounted filesystem. The attacker must already hold low-privileged authenticated access (PR:L) on an affected build (see EUVD ranges spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025); no user interaction (UI:N) and low complexity (AC:L) are involved. Limiting factors: valid local credentials are required, exploitation targets the exFAT code path (a system must actually process the malicious exFAT structure), and Microsoft's AV:N 'over a network' claim is unverified for a file-system parsing bug and should be confirmed with the vendor before assuming remote reachability. A vendor patch is available and is the definitive mitigation.

This is a Microsoft-rated CVSS 3.1 8.8 (High) elevation-of-privilege flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Windows exFAT file-system driver, stemming from an out-of-bounds read (CWE-125). The signals point to a genuine but not top-tier emergency: EPSS is low at 0.77% (53rd percentile), CISA's SSVC framework marks Exploitation as 'none' and Automatable as 'no' (while acknowledging Technical Impact as 'total'), and there is no public exploit identified at time of analysis and no CISA KEV listing. The most important caveat is a vector/description tension: the description says the attacker can 'elevate privileges over a network' and Microsoft assigns AV:N, yet an out-of-bounds read in a file-system parser is normally triggered by processing a crafted volume/image (local vector, AV:L). This AV:N is Microsoft boilerplate for file-system bugs and should be treated skeptically - verify the real delivery path with the vendor. The PR:L (authorized attacker) requirement and lack of automation/known exploitation mean this is a patch-in-normal-cycle priority rather than an out-of-band scramble, but the ubiquity of Windows and the kernel-level 'total' impact make it a firm must-patch across the fleet.

An attacker who already has low-privileged authenticated access to a Windows host supplies a maliciously crafted exFAT-formatted volume or image (e.g., removable media or a mounted disk image) that, when parsed by the exFAT driver, triggers an out-of-bounds read in kernel context, leaking memory or corrupting driver state to escalate to SYSTEM. Per CVSS the complexity is low (AC:L) and no user interaction is required (UI:N), but valid low-level credentials (PR:L) are needed; no public proof-of-concept exploit has been identified at time of analysis.