Microsoft Windows UDFS: Use-after-free allows local privilege escalation

Summary

The Universal Disk Format File System Driver (UDFS) in Windows, which handles UDF volumes such as optical media and disk images, contains a use-after-free flaw. A local attacker with a low-privilege account can exploit it to elevate privileges, with full impact on confidentiality, integrity and availability. The attack requires local access and is not internet-facing. Third-party data classifies the flaw as a buffer overflow (CWE-190, CWE-122), which conflicts with the vendor description.

Affected

• Per the CNA record: Windows 10 Version 1607 and Windows Server 2016 (builds before 10.0.14393.9612)
• Also listed by the CNA: Windows 10 1809, 21H2, 22H2, Windows 11 23H2 to 26H2, and Windows Server 2012 and 2012 R2
• The CNA table is the reference; verify the full list on the MSRC page.

Fixed in

• Unknown. The CNA record implies 10.0.14393.9612 as the first fixed build for Windows 10 1607 and Server 2016, but this is not confirmed by a fix description.
• Microsoft release health lists KB5126868 (OS build 14393.9612) as the October 2026 update for this version. Its link to this CVE is unconfirmed.

Workaround

• Unknown. No vendor workaround found.
• Generic measures (not vendor-confirmed): restrict local logon to trusted users, limit local accounts, and avoid untrusted UDF media and disk images.

Exploitation

• No evidence of exploitation in the wild found. CISA SSVC: exploitation none, not automatable.
• Not listed in CISA KEV. EPSS below 1%.
• No public proof of concept found, which does not rule one out.

Our recommendation

• Check for Windows 10 1607 devices. This version reached end of support on 13 October 2026 and gets no further security updates unless Extended Security Updates (ESU) are purchased.
• Plan a migration or an ESU decision. For devices that cannot be upgraded, apply the generic measures above.
• Install the October 2026 cumulative update where available and verify the fixed build on the MSRC page.
• Restrict local access on shared kiosks, POS systems and HMIs, and monitor for privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85820 msrc.microsoft.com
• Microsoft Learn: Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• NVD mirror on Vulners: CVE-2026-85820 vulners.com
• Microsoft CVE mirror on Vulners: MS:CVE-2026-85820 vulners.com
• OpenCVE: CVE-2026-85820 app.opencve.io
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:07.