Microsoft Windows UDFS: Heap-based buffer overflow enables local privilege escalation

Summary

A heap-based buffer overflow in the Windows Universal Disk Format (UDF) File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The attacker needs local access and an existing low-privilege account, so the flaw is not reachable from the internet. Successful exploitation would give full control over confidentiality, integrity and availability of the affected system.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2 and 22H2: builds before 10.0.19044.7846 and 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2, 25H2 and 26H2: builds before 10.0.26100.9974, 10.0.26200.9974 and 10.0.26300.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows Server 2022: builds before 10.0.20348.5870
• Note: third-party sources list additional products and different build numbers; verify against the MSRC page.

Fixed in

• Fixed in the Microsoft security update of November 10, 2026 (Patch Tuesday).
• First fixed builds per the CVE record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.20348.5870, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.26300.9974, 10.0.28000.3501.
• Unconfirmed third-party KB references: KB5132061 (Windows 11 24H2/25H2/26H2), KB5131090 (Windows Server 2022), KB5131085 (Windows Server 2019 and 1809), KB5132059 (Windows 11 26H1).

Workaround

• No vendor workaround found. Status: unknown.
• Limit mounting untrusted UDF or ISO media on shared or multi-user systems until patched (own recommendation, not from a vendor source).

Exploitation

• No evidence of exploitation in the wild. CISA SSVC: Exploitation none. Senserva: Exploited No.
• No public proof of concept found. This does not prove that none exists.
• CVE record temporal metrics: E:U (exploit maturity unproven), RC:C (report confirmed).

Our recommendation

• Install the November 2026 Microsoft security update on all affected Windows systems, with priority on shared workstations, terminal or RDS servers and systems where untrusted users can log on or mount media.
• Until patched, restrict mounting of untrusted UDF or ISO media on multi-user systems.
• Review which accounts can log on locally and remove unneeded accounts.
• Monitor for a public proof of concept and recheck the NVD and CISA KEV status within a few days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119840 msrc.microsoft.com
• CVE Record CVE-2026-119840 www.cve.org
• Strix: CVE-2026-119840 www.strix.ai
• GBHackers: Microsoft November 2026 Patch Tuesday gbhackers.com
• Senserva: KB5132061 senserva.com
• Senserva: KB5131090 senserva.com
• Senserva: KB5131085 senserva.com
• Senserva: KB5132059 senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:56.