Windows UDFS driver: Elevation of privilege vulnerability

Summary

The Windows Universal Disk Format File System Driver (UDFS) contains a memory corruption flaw that allows an authorized local user to elevate privileges. The CVE description calls it a use-after-free, but the CWE is CWE-122 (heap-based buffer overflow), so the exact vulnerability class is not settled. Exploitation requires a local account with low privileges, so the risk is mainly as a second stage after a user account has been compromised.

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds before 10.0.14393.9612
• Windows 10 Version 1809: builds before 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: builds before 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2: builds before 10.0.26100.9711
• Windows 11 Version 25H2 and 26H2: builds before 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows Server 2012 and Server Core: builds before 6.2.9200.26434
• Windows Server 2012 R2 and Server Core: builds before 6.3.9600.23470

Fixed in

• Fixed in the October 2026 security updates for the builds listed above (CNA data).
• Knowledge Base numbers were not confirmed from the MSRC advisory; KB5126651 (Windows 10 1809 / Server 2019) and KB5126646 (Windows Server 2025) were reported by third-party databases only.
• Windows 10 1607 fix: no KB number found; confirm on MSRC.

Workaround

• None known. Unknown whether MSRC lists an interim mitigation.

Exploitation

• No evidence of active exploitation found in the sources reviewed.
• CISA SSVC (Vulnrichment): Exploitation none, Automatable no, Technical Impact total.
• No CISA KEV entry found in the sources accessed.
• No public proof of concept found.

Our recommendation

• Inventory all Windows systems, including Windows 10 1607, Windows 10 1809 and Windows Server 2012/2016.
• Install the October 2026 cumulative updates, verifying the KB number for each build on MSRC.
• Prioritize multi-user systems and terminal servers.
• Plan Extended Security Updates for systems still on Windows 10 1607 and confirm licensing.
• Re-check CISA KEV and MSRC for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83513 msrc.microsoft.com
• NVD record via Vulners: CVE-2026-83513 vulners.com
• CVE list record via Vulners: CVE-2026-83513 vulners.com
• OpenCVE: CVE-2026-83513 (includes CISA SSVC data) app.opencve.io
• Strix: CVE-2026-83513 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:41.