Windows UDFS driver: Elevation of privilege by local attacker

Summary

A flaw in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker with local access and a low-privilege account to elevate privileges, with high impact on confidentiality, integrity and availability (CVSS 7.8). UDF is used for optical discs and many removable media, so the driver is typically reached when such media are mounted. The memory-corruption class is inconsistently reported across sources (use after free in the description, CWE-121 in the record) and remains to be confirmed against the MSRC advisory.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 1607 and Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2 and 26H2: 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012 and 2012 R2: Unknown.
• Server 2019, 2022 and 2025: not in the CNA record; secondary sources name 10.0.17763.9376, 10.0.20348.5761 and 10.0.26100.33650. Verify with Microsoft.
• Cumulative updates named by secondary sources: KB5126651 (Windows 10 1809, Server 2019) and KB5126646 (Server 2025). Other KB numbers: Unknown.

Workaround

Unknown from the vendor. One aggregator suggests blocking the UDFS driver for removable media via Device Installation Restrictions or a Group Policy; this is not confirmed by Microsoft and must be verified before use.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• No evidence of exploitation in the wild; not listed in CISA KEV according to OpenCVE.
• No public proof of concept found.
• EPSS 0.00353 (very low predicted exploitation probability).

Our recommendation

• Install the October 2026 security updates for your Windows build as part of the normal patch cycle.
• Prioritise shared PCs, terminal servers and systems where users mount USB sticks or external media.
• Treat Windows 10 1607 / LTSB 2016 and Server 2012 systems as unsupported or unverified: replace them or isolate them until a fix is confirmed.
• Verify affected builds against the MSRC advisory before deployment.
• Restrict mounting of removable media where operationally possible and monitor for privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83857 msrc.microsoft.com
• Vulners CVE list entry CVE-2026-83857 vulners.com
• Vulners NVD entry CVE-2026-83857 vulners.com
• OpenCVE CVE-2026-83857 app.opencve.io
• Strix CVE-2026-83857 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:47.