Microsoft Windows: Heap-based buffer overflow in UDFS driver allows local privilege escalation

Summary

A heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The CVSS base score is 7.8 (High), with high impact on confidentiality, integrity and availability. Exploitation requires local access with low privileges, for example through a user or malware already on the system, or through mounting untrusted optical or removable media.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (including Server Core installations)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)

Fixed in

• Install the Microsoft security update for October 13, 2026 for your Windows version. Fixed builds according to the CNA record are listed in the affected ranges above (upper bound is the fixed build).
• Windows 10 1607 / Server 2016: 10.0.14393.9612 or later. Knowledge base article number: Unknown. Please verify on the MSRC page.

Workaround

Unknown.

Exploitation

• No exploitation in the wild known.
• No public proof-of-concept known.
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Patch affected systems in the normal update cycle, prioritising Windows 10 1607 and Windows Server 2012/2016 systems.
• Verify the fixed build and KB article for each version on the MSRC update guide before rollout.
• Check whether Windows 10 1607 is still supported by Microsoft; if not, plan migration, because no further fixes may be provided.
• Limit local logon and restrict mounting of untrusted optical or removable media on systems that cannot be patched immediately.
• Monitor for public exploit code or a CISA KEV entry.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102218 msrc.microsoft.com
• Vulners: CVE-2026-102218 (CVE list entry) vulners.com
• Strix: CVE-2026-102218 www.strix.ai
• Tenable plugin 365475 (Windows 10 1809 / Server 2019 update) www.tenable.com
• EUVD-2026-100367 (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:13.