CVE-2026-96953: Windows UDFS Use-After-Free Vulnerability

CVE-2026-96953 Overview

CVE-2026-96953 is a null pointer dereference vulnerability [CWE-476] in the Windows Universal Disk Format File System Driver (UDFS). An authorized local attacker can trigger the flaw to execute code with elevated privileges. The affected component is a kernel-mode driver that parses UDF-formatted media, so successful exploitation yields code execution in the kernel context. Microsoft disclosed the issue through the Microsoft Security Response Center (MSRC) and assigned a high severity rating.

Critical Impact
A local, authenticated attacker can achieve code execution in the Windows kernel by triggering a null pointer dereference inside the UDFS driver, resulting in full compromise of confidentiality, integrity, and availability on the host.

Affected Products

Microsoft Windows (Universal Disk Format File System Driver component)
Windows kernel-mode UDFS driver (udfs.sys)
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-10-13 - CVE-2026-96953 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-96953

Vulnerability Analysis

The vulnerability resides in the Windows Universal Disk Format File System Driver, which implements read and write support for UDF media such as DVDs, Blu-ray discs, and mountable disc images. The driver dereferences a pointer that can be NULL under attacker-controlled conditions during file system parsing. Because UDFS runs in kernel mode, dereferencing an uninitialized or unvalidated pointer produces a bugcheck under normal circumstances. When an attacker shapes kernel memory so that the referenced address is attacker-controlled, the condition becomes a local code execution primitive instead of a crash.

The attack requires local access and low privileges but no user interaction. A standard user who can mount or attach a crafted UDF image can reach the vulnerable parsing path. Successful exploitation delivers kernel-level code execution, enabling privilege escalation to SYSTEM.

Root Cause

The root cause is a missing null check [CWE-476] along a UDFS parsing path. Metadata structures within a malformed UDF volume cause the driver to follow a pointer that was never populated with a valid object reference. The driver reads or writes through that pointer without validation, producing undefined behavior inside the kernel.

Attack Vector

An authenticated local attacker crafts a malicious UDF volume and causes the operating system to mount or parse it. This can occur through inserting removable media, attaching a disc image file, or invoking file system operations that touch the crafted structures. The parsing path inside the UDFS driver dereferences the controlled pointer and transfers execution to attacker-influenced memory.

No verified public exploit or proof-of-concept has been published. Technical specifics are limited to the Microsoft advisory. See the Microsoft Security Update Guide for authoritative details.

Detection Methods for CVE-2026-96953

Indicators of Compromise

Unexpected mount events for UDF-formatted media or disc image files (.iso, .img, .udf) initiated by non-administrative users.
Kernel bugchecks referencing udfs.sys with stop codes consistent with access violations or null pointer dereferences.
New or unknown processes executing with SYSTEM privileges shortly after UDFS mount activity.

Detection Strategies

Monitor Windows Event Log for driver crash events (Event ID 1001, BugCheck) that implicate udfs.sys.
Alert on PnP and volume-mount telemetry involving UDF file systems, especially for ISO or disc image files written to user-writable paths.
Correlate local privilege escalation telemetry with recent UDFS parsing activity to catch exploitation chains.

Monitoring Recommendations

Enable kernel crash dump collection on endpoints to retain forensic evidence of exploitation attempts.
Track image loads of udfs.sys on systems that do not regularly process optical media.
Baseline normal use of removable media and flag deviations in enterprise fleets.

How to Mitigate CVE-2026-96953

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide across all Windows endpoints and servers.
Prioritize patching on multi-user systems where low-privileged accounts can mount removable media or disc images.
Audit endpoints for unpatched udfs.sys builds and schedule remediation.

Patch Information

Microsoft has released a security update addressing this vulnerability. Deploy the update through Windows Update, Microsoft Update Catalog, Windows Server Update Services (WSUS), or your enterprise patch management workflow. Confirm the fixed udfs.sys version on representative systems after deployment.

Workarounds

Restrict the ability to mount removable media and disc images through group policy where business requirements allow.
Disable automatic mounting of ISO and UDF files by removing the default handler association for standard users.
Apply application control policies to block execution of binaries dropped from untrusted UDF volumes until patches are deployed.

bash

# Example: block automatic mounting of ISO/IMG files for standard users via registry
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v NoAutoplayfornonVolume /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0xFF /f