Windows 10 1607: Use after free in UDF file system driver allows privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The attacker needs local access with low privileges, and no user interaction is required. Successful exploitation gives high impact on confidentiality, integrity and availability (CVSS 7.8).

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Other affected Windows 10, Windows 11 and Windows Server branches are listed in the CNA record, including Server 2012, 2012 R2 and 2016

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612 or later, provided by the October 2026 security update
• Exact KB number: Unknown. Tenable maps the fix to KB5126868, which could not be verified against Microsoft's KB page

Workaround

• No workaround is documented by the vendor.
• Interim measures (own recommendation, not from the vendor): restrict local interactive logon, limit low-privilege accounts on shared systems, and avoid mounting untrusted UDF media until patched.

Exploitation

• Not publicly disclosed and not known to be exploited (MSRC).
• Exploit code maturity: Unproven (MSRC).
• CISA SSVC: exploitation none, not automatable.
• EPSS below 1%.
• No public proof of concept found in our searches; this does not prove none exists.

Our recommendation

• Install the October 2026 Microsoft security update on all affected Windows hosts, starting with multi-user systems, terminal servers and shared workstations.
• Identify any remaining Windows 10 1607 hosts and plan replacement or an upgrade, since this version is out of support.
• Restrict local logon and avoid mounting untrusted UDF media until patched.
• Verify the KB number on the Microsoft Security Update Guide before deployment.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96946 msrc.microsoft.com
• Vulners: CVE-2026-96946 (CNA data) vulners.com
• Tenable: CVE-2026-96946 plugins www.tenable.com
• OpenCVE: CVE-2026-96946 app.opencve.io
• Strix: CVE-2026-96946 (contains known data errors) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:37.