Windows UDFS driver: NULL pointer dereference allows local code execution

Summary

A NULL pointer dereference in the Windows Universal Disk Format File System Driver (UDFS) allows an authorized local attacker to execute code. The driver reads UDF-formatted media such as optical discs and disk images. Exploitation requires a low-privileged local account and no user interaction, so the risk is mainly on shared PCs, terminal servers and systems where users can mount removable media. Microsoft rates the CVSS base score at 7.8 (High).

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 incl. Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Per the CNA record, the fixed build for Windows 10 Version 1607 and Windows Server 2016 is 10.0.14393.9612; for other products the fixed builds are listed in the same record.
• The KB article for each product is not confirmed by this review. Check the MSRC Security Update Guide for the exact KB and build.

Workaround

• Microsoft lists a patch; no vendor-published workaround is known.
• An interim measure from a third-party tracker (not from Microsoft): restrict standard users from mounting removable media, or use Device Guard or code integrity policies.

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• Microsoft temporal metrics: exploit code maturity Unproven (E:U), report confirmed.
• No public proof of concept or exploitation reports were found in the research. This is not proof that none exists.
• Third-party data lists a very low EPSS score (below 1%) and no CISA KEV entry; the KEV status was not verified against the live catalog.

Our recommendation

• Install the October 2026 security update on all listed Windows systems, starting with Windows 10 Version 1607 and other systems with several users or unsupervised removable-media access.
• Check whether Windows 10 Version 1607 is still in use and whether it is still supported. If support has ended, plan a migration or check whether Extended Security Updates apply.
• Until patched, restrict standard users from mounting removable media where operationally possible.
• Monitor for unusual process activity on shared systems and terminal servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96953 msrc.microsoft.com
• CNA record mirror (Vulners) vulners.com
• OpenCVE: CVE-2026-96953 (EPSS, KEV, mitigation) app.opencve.io
• EUVD listing (EUVD-2026-100275) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:34.