Windows UDFS: Local privilege escalation via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker with an existing local account to elevate privileges. The attack requires local logon, so it is a second-stage risk rather than an internet-facing entry point. The CVE record conflicts on the weakness type (CWE-416 versus heap overflow) and on the attack vector (AV:N in the CVSS vector), so the MSRC advisory must be checked before final rating.

Affected

• Windows 10 Version 1607: builds 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809: builds 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: builds 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: builds 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: builds 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: builds 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2016 (including Server Core): builds 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 (including Server Core): builds 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Fixed in the builds listed as the upper limits above, shipped with the November 2026 Patch Tuesday updates.
• The KB number per build is unknown from the sources; check the MSRC page.

Workaround

Unknown. No vendor workaround has been documented.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Microsoft exploit maturity: Unproven (E:U).
• No evidence of exploitation in the wild and no public proof of concept found.

Our recommendation

• Install the November 2026 cumulative update on all affected Windows systems, starting with terminal servers, RDS hosts and shared endpoints.
• Limit interactive local logons on shared systems and restrict who can mount removable media.
• Verify the affected builds and KB numbers against the MSRC advisory before rating the risk.
• Monitor for unexpected privilege changes on multi-user systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-119837 www.cve.org
• Microsoft Security Response Center advisory CVE-2026-119837 msrc.microsoft.com
• VulDB entry 434178 vuldb.com
• BleepingComputer: November 2026 Patch Tuesday www.bleepingcomputer.com
• Qualys: November 2026 Patch Tuesday review blog.qualys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:32.