Windows exFAT EUVD-2026-99531

Requires local, authenticated low-privilege access to an affected Windows host (CVSS PR:L), after which the attacker must get the vulnerable exFAT driver to parse attacker-controlled exFAT file system metadata - in practice by having a crafted exFAT-formatted volume (e.g., a malicious USB device, mounted disk image, or VHD) processed by the system. CVSS UI:N indicates no interaction by a separate victim user is modeled. Limiting factors: no remote network vector (AV:L), the attacker needs an existing foothold/account on the machine, and the target must process the malicious exFAT volume; environments that block removable media or restrict mounting of untrusted images materially reduce exposure. Applies broadly across supported Windows 10, Windows 11 (23H2-26H2), and Windows Server 2012 through 2025 builds below the patched versions listed in EUVD.

This is a credible, patch-now-class local privilege escalation rather than a hype-driven high-CVSS item. The CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description of a heap-based buffer overflow (CWE-122) in the Windows exFAT file system allowing an authorized attacker to elevate privileges locally. All three real-world acceleration signals are, however, ABSENT from the input: there is no EPSS score, no CISA KEV listing, and no POC indicator - therefore exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision record supplied. The attack vector is Local with Low complexity and no user interaction, but it requires existing low-privilege authenticated access (PR:L), which bounds the blast radius to post-compromise escalation (e.g., chaining after a phishing foothold or a low-priv service). The signals are not conflicting - they consistently point to a serious-but-not-remote local EoP. The dominant risk driver is the enormous install base (Windows), not exploitation evidence. Treat as high priority for patch prioritization on multi-user, kiosk, and removable-media-exposed hosts, while noting the local-access prerequisite lowers mass-exploitation likelihood absent a public exploit.

A low-privileged but authenticated attacker on a Windows host (or malware running in a restricted context) supplies a maliciously crafted exFAT volume - for example a specially formatted USB device or disk image - whose metadata triggers a heap-based buffer overflow when the exFAT driver parses it. Successful corruption of kernel heap structures lets the attacker elevate to SYSTEM. No public exploit code is identified at time of analysis, and CVSS AC:L suggests the overflow is reliably reachable once the attacker can get the volume parsed.