The vulnerability is a null pointer dereference in the Windows Universal Disk Format File System Driver (UDFS), allowing an authorized attacker with local access to execute code when the driver processes a malicious UDF image. The flaw can lead to arbitrary code execution under the privileges of the system process, thereby compromising confidentiality, integrity, and availability of the affected computer. The issue is mapped to CWE-122 (Heap Buffer Overflow) and CWE-190 (Integer Overflow or Wraparound).

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 including their Server Core and standard editions. The flaw affects the native UDFS driver integrated into these operating systems, which is used to read ISO-9660 or UDF file system removable media.

The CVSS score of 6.8 indicates medium severity, while the EPSS score of less than 1% signals a very low probability of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog, suggesting fewer publicly documented exploits. The attack vector is inferred to be a physical attack that involves supplying a specially crafted UDF image to the target system. Successful exploitation would allow the attacker to run code with elevated privileges, potentially leading to full system compromise. Given the medium severity and low exploitation probability, the risk is considered moderate, but organizations should address the issue promptly to mitigate potential future exploitation.