Microsoft Windows UDFS driver: Use-after-free allows local privilege escalation

Summary

A use-after-free flaw (CWE-416) in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to elevate privileges. The attacker needs a valid local account and must be able to mount or interact with UDF volumes. Successful exploitation could lead to full compromise of the affected host, which is most relevant on shared workstations, terminal servers and file servers.

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (build 10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (build 10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (build 10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (build 10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (build 10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (build 10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (build 10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (build 10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 and Server Core (build 6.2.9200.0 before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (build 6.3.9600.0 before 6.3.9600.23470)
• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)

Note: The NVD CPE entry lists only Windows 10 1607; the CNA record lists the products above.

Fixed in

• Install the Microsoft security update for each affected product. The fixed builds are listed in the Affected section (for example 10.0.14393.9612 for Windows 10 1607 and Windows Server 2016).
• The KB number per product is not confirmed in the sources. Take it from the MSRC update guide for the specific build.

Workaround

• No workaround is documented by Microsoft. The update is the fix.
• Interim option (not from a vendor source, reduces exposure only): restrict local logon rights and limit mounting of removable UDF media (USB, optical) through policy until the update is installed.

Exploitation

• Microsoft: not publicly disclosed, not exploited, exploitability assessment 'Exploitation Less Likely'.
• Microsoft states no publicly available exploit code exists, or an exploit is theoretical.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in CISA KEV. No public proof of concept found.

Our recommendation

• Patch affected Windows systems in the normal monthly cycle, prioritising multi-user systems, terminal servers and file servers.
• Check every affected build in the inventory, including Windows 10 1607 and Windows Server 2016 hosts, and plan upgrades for systems that are out of support.
• Verify the end-of-support date for Windows 10 1607 (LTSB 2016) on Microsoft's lifecycle page; this was not confirmed in the sources.
• Until patched, limit local accounts and restrict mounting of removable UDF media.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96947 msrc.microsoft.com
• Vulners: CVE-2026-96947 (CNA data) vulners.com
• OpenCVE: CVE-2026-96947 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:36.