Microsoft Windows 10 1607: Use-after-free in UDFS driver (local privilege escalation)

Summary

A use-after-free flaw (CWE-416) in the Windows Universal Disk Format File System Driver (UDFS) of Windows 10 Version 1607 allows an authorized local user to elevate privileges. An attacker needs a local account or code already running on the machine; no user interaction is required. Microsoft rates the flaw High (CVSS 7.8), and CISA SSVC lists no known exploitation.

Affected

• Microsoft Windows 10 Version 1607 (32-bit and x64), builds 10.0.14393.0 up to, but not including, 10.0.14393.9612
• Other Windows versions are also listed in the CNA record; see the MSRC advisory for the complete list.

Fixed in

• Microsoft Windows 10 Version 1607: build 10.0.14393.9612 or later (per the CNA record; verify on the MSRC page)

Workaround

Unknown. No workaround is documented by Microsoft.

Exploitation

• Microsoft: Exploited: No; exploit code maturity: Unproven.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept known at the time of research.

Our recommendation

• Install the Microsoft security update for Windows 10 Version 1607 that provides build 10.0.14393.9612 or later; confirm the correct package on the MSRC page.
• Confirm that Version 1607 still receives security updates for your edition before relying on the patch.
• If a system cannot be patched immediately, restrict local logon and removable media use on it as an interim measure.
• Prioritize this host: an unsupported or outdated OS accumulates unpatched flaws.
• Monitor for unusual local privilege changes or new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-96950 msrc.microsoft.com
• CNA affected-version data (Vulners mirror) vulners.com
• OpenCVE: CVSS, CISA SSVC and EPSS data app.opencve.io
• VulDB: CVE-2026-96950 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:36.