Windows UDFS driver: Heap-based buffer overflow enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The attacker needs a low-privileged logon on the system first, for example through a phished user or malware running as a standard user. The flaw is not reachable from the internet. CVSS 3.1 base score is 7.8 (High).

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (incl. Server Core)
• Windows Server 2016
• Windows Server 2019 and 2022 and 2025 (according to secondary sources, not in the CNA record)

Note: the NVD CPE lists only Windows 10 1607.

Fixed in

Fixed in the Microsoft security updates of October 13, 2026 (Patch Tuesday). Fixed build numbers are listed in the affected section, but they are not yet confirmed against the MSRC advisory. Unknown: the exact fixed build for Windows 10 1607 and Server 2016 (probably KB5126868).

Workaround

Unknown. No workaround or mitigation is documented in the sources reviewed. Patching is the expected fix.

Exploitation

• Exploited in the wild: not confirmed. The CISA KEV status for this CVE is unclear and must be checked directly at CISA.
• Public proof-of-concept exploit: not found (no dedicated search was run).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score: 0.00318 (low predicted exploitation probability).

Our recommendation

• Install the October 2026 security updates on all affected systems, starting with Windows 10 1607 and Server 2016 systems and with multi-user systems, terminal servers and Remote Desktop hosts.
• Verify the fixed build numbers against the MSRC advisory before relying on them.
• Check whether 1607 and Server 2016 systems are still supported and in use; replace them if not.
• Limit local logons on shared systems and monitor for unusual privilege changes.
• Restrict the use of untrusted ISO files and optical or removable media as a general hardening step.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102205 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-102205 vulners.com
• CNA affected products (Vulners): CVE-2026-102205 vulners.com
• Affected ranges and CVSS vector (Strix) www.strix.ai
• Update listings (Vulners EUVD-2026-100360) vulners.com
• Tenable plugin for KB5126868 (Windows 10 1607) www.tenable.com
• Tenable plugin for KB5126657 (KEV date, scope unclear) www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:16.