Windows UDFS EUVD-2026-99909

Requires local, authenticated access to the host (AV:L, PR:L) - the attacker must already be able to execute code as a standard user; no user interaction is needed (UI:N). The concrete trigger is parsing of a malformed UDF (Universal Disk Format) volume by the UDFS.sys driver, i.e. mounting or accessing a crafted UDF-formatted image/optical medium, which drives the kernel into a use-after-free (CWE-122). Limiting factors: there is no remote vector (not network-reachable), and the attacker needs a prior foothold on the system; the vulnerable code path lives in a kernel driver present by default, so no non-default feature toggle is required. All listed Windows 10/11 and Windows Server builds below the patched versions are affected.

All exploitation signals point to a moderate, patch-in-due-course priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local attack by an already-authenticated low-privileged user with low complexity and no user interaction, yielding total impact (C:H/I:H/A:H) - consistent with a kernel-driver elevation-of-privilege to SYSTEM. CISA's SSVC framework reinforces the lower urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-exploited, as expected for a local EoP requiring prior code execution), though Technical Impact=total matches the CVSS high-impact triad. There is no CISA KEV listing and no public exploit referenced, so this is 'no public exploit identified at time of analysis.' EPSS score was NOT provided in the input and cannot be factored in. One conflict to flag: the input Tags include 'Denial Of Service,' but the description and CWE-122 (heap-based buffer overflow / use-after-free) describe privilege elevation, not a DoS primitive - treat the DoS tag with caution. Net: a credible local privilege-escalation bug worth patching on the normal cycle, but not a widespread-exploitation emergency based on available signals.

A low-privileged local user (or malware already running in a limited context) crafts a malformed Universal Disk Format volume and causes the vulnerable UDFS driver to parse it, triggering a use-after-free in kernel memory that is groomed into arbitrary code execution and elevation to SYSTEM. No public proof-of-concept is referenced in the input, and exploitation requires prior local authenticated access (PR:L, AV:L) with no user interaction.