Windows UDFS EUVD-2026-99529

Requires a local, authenticated low-privileged foothold on the Windows host (PR:L, AV:L) with no user interaction needed. The attacker must be able to reach the Universal Disk Format File System (UDFS) driver's parsing code - for example by mounting or causing the system to parse a maliciously crafted UDF-formatted volume (such as a UDF optical-disc/ISO image) - to trigger the use-after-free. Limiting factors: there is no remote or network vector, exploitation cannot be automated/wormed (SSVC Automatable=no), and the attacker needs prior code execution as a standard user; it is not reachable by unauthenticated or remote attackers against a default standalone configuration.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already have a low-privileged authenticated foothold (PR:L), after which exploitation is local-only with low complexity and no user interaction, yielding full confidentiality, integrity and availability impact - consistent with kernel-level code execution via a use-after-free (CWE-122 heap corruption). The exploitation signals argue AGAINST treating this as a top-of-queue item: CISA SSVC records Exploitation=none and Automatable=no (expected for a local EOP, which cannot be mass-scanned/wormed), and there is no CISA KEV listing and no public exploit identified at time of analysis. SSVC Technical Impact=total aligns with the C:H/I:H/A:H kernel impact. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. Net: a genuine defense-in-depth concern typically chained after initial access to reach SYSTEM, but the local-only vector plus absence of known exploitation makes it a routine-patch-cycle item rather than an exploited-in-the-wild crisis. One data note: the input Tags include 'Denial Of Service' and 'Buffer Overflow', while the description and CWE-122 point to a heap use-after-free enabling privilege elevation - DoS is at most a secondary effect, so treat the primary impact as EOP.

A standard user (or malware running with limited rights) on a Windows host supplies a crafted UDF-formatted volume or triggers UDFS parsing to drive the file-system driver into a use-after-free condition in kernel memory. By grooming the heap and reclaiming the freed object, the attacker achieves kernel-mode code execution and escalates from low privileges to SYSTEM. No public proof-of-concept or active exploitation has been identified at time of analysis, and the local-only vector means no remote reachability.