CVE-2026-62699 Overview
CVE-2026-62699 is a heap-based buffer overflow [CWE-122] in the Windows Universal Disk Format File System Driver (UDFS). The vulnerability allows an unauthorized attacker to execute code by presenting a crafted UDF-formatted volume to a target system through physical media access. Microsoft has assigned the flaw a CVSS 3.1 score of 6.8 across supported Windows client and server editions.
The UDFS driver parses volumes formatted with the Universal Disk Format specification, commonly used on optical media and some removable devices. Successful exploitation results in code execution in the context of the driver, which runs in kernel mode.
Critical Impact
Successful exploitation grants code execution in kernel context, delivering full confidentiality, integrity, and availability impact on affected Windows hosts.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62699 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62699
Vulnerability Analysis
The flaw resides in the Windows UDFS kernel-mode driver responsible for mounting and parsing Universal Disk Format volumes. When the driver processes structural metadata from an attacker-controlled UDF volume, it writes past the bounds of a heap-allocated buffer. This memory corruption can be steered to overwrite adjacent kernel pool structures.
Because UDFS executes within the Windows kernel, attacker-controlled memory writes can be leveraged to achieve arbitrary code execution at ring 0. The physical attack vector reflects the requirement that the malicious volume be presented to the target machine, typically via optical disc, USB storage formatted with UDF, or a virtually attached image on a system with physical console access.
Root Cause
The root cause is insufficient validation of length or offset fields within UDF volume descriptors before they are used to size or index heap allocations inside the driver. When the driver trusts an attacker-supplied field, subsequent copy operations exceed the allocated buffer, corrupting the kernel pool. This class of defect is tracked as CWE-122: Heap-based Buffer Overflow.
Attack Vector
An attacker crafts a malformed UDF-formatted volume containing manipulated descriptor fields. The attacker then inserts the media or attaches the storage device to a target machine. When Windows auto-mounts or a user browses the volume, UDFS parses the malicious structures and triggers the overflow. No authentication or user interaction beyond mount is required, but physical proximity to the device is necessary.
No public proof-of-concept, exploit code, or reports of in-the-wild exploitation are available at time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.418%.
See the Microsoft Security Update CVE-2026-62699 advisory for vendor technical details.
Detection Methods for CVE-2026-62699
Indicators of Compromise
- Unexpected mounts of UDF-formatted removable media on servers or workstations that do not routinely handle optical or USB storage.
- udfs.sys driver crashes, bugchecks referencing UDFS, or kernel pool corruption entries in Minidump and WER logs.
- Anomalous kernel-mode process creation or privilege changes immediately following a removable media insertion event.
Detection Strategies
- Monitor Windows event logs for storage volume mount events (Event IDs 98, 507) followed by driver faults involving udfs.sys.
- Alert on unsigned or unexpected child processes launched by System or services.exe after removable media insertion.
- Correlate USB and optical device insertion events with subsequent kernel exceptions or unexpected reboots.
Monitoring Recommendations
- Enable and centralize Windows kernel crash telemetry to identify UDFS-related bugchecks across the fleet.
- Track removable media policy violations through Group Policy auditing and endpoint telemetry.
- Review physical access logs for high-value hosts, including servers with unattended console access.
How to Mitigate CVE-2026-62699
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62699 to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching hosts with exposed physical ports, including kiosks, conference-room systems, and unattended servers.
- Restrict removable media use through Group Policy where UDF media is not required for business operations.
Patch Information
Microsoft has released security updates addressing CVE-2026-62699. Consult the Microsoft Security Update Guide for the specific KB article and cumulative update corresponding to each Windows build. Apply updates through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management tooling.
Workarounds
- Disable automatic mounting of removable media by configuring NoDriveTypeAutoRun and disabling AutoPlay via Group Policy.
- Block or restrict UDF-formatted media through device installation restrictions or endpoint device control policies.
- Enforce physical security controls limiting console and USB port access on servers and sensitive endpoints.
# Example Group Policy registry configuration to disable AutoPlay on removable media
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0xFF /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoAutoplayfornonVolume /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
