Microsoft Windows UDFS driver: Heap-based buffer overflow allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The attacker needs a low-privilege account on the affected system, so the flaw is not directly reachable from the internet. Successful exploitation could give the attacker full control over the system (CVSS 3.1 7.8, high).

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9612)
• Windows 10 Version 1809 (builds below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds below 10.0.19044.7807)
• Windows 10 Version 22H2 (fixed build to be verified with MSRC)
• Windows 11 Version 23H2 (builds below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds below 10.0.26300.9711)
• Windows Server 2012 and Server Core (builds below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (builds below 6.3.9600.23470)
• Windows Server 2016 (builds below 10.0.14393.9612)
• Windows Server 2019, 2022 and 2025 (per secondary source, verify with MSRC)

Fixed in

• Install the October 2026 security update for your Windows version. The CNA data lists the fixed builds above.
• Windows 10 Version 1607 and Server 2016: 10.0.14393.9612 or later. The KB number is unknown.
• Windows 10 22H2: fixed build unknown, verify with MSRC.

Workaround

Unknown.

Exploitation

• No confirmed in-the-wild exploitation found.
• Not listed as known exploited (KEV) in the sources reviewed.
• No public proof of concept found; this is not a confirmed absence.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Apply the October 2026 cumulative update to all affected Windows systems, starting with multi-user systems such as terminal servers and shared PCs.
• Prioritise Windows 10 Version 1607 and Server 2016 systems and check whether they are still supported or covered by Extended Security Updates.
• Restrict local logons and remove unneeded accounts.
• Limit handling of untrusted removable media and ISO images, as UDF is the format used by DVDs and many ISO files.
• Verify the exact fixed builds, especially for Windows 10 22H2, in the MSRC advisory.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-102215 msrc.microsoft.com
• Vulners: CVE-2026-102215 (CNA data) vulners.com
• Vulners: NVD record CVE-2026-102215 vulners.com
• Strix: CVE-2026-102215 www.strix.ai
• Tenable Nessus plugin 365473 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:11.