The UDFS driver contains a use‑after‑free flaw that, when triggered, allows a local user to gain privileges higher than those of the process that initially accessed the driver. This race condition aligns with CWE‑362 and can be exploited by manipulating the filesystem interface provided by UDFS, resulting in unauthorized elevation of privileges on the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025, including Server Core installations. All builds listed include the vulnerable UDFS driver.

The CVSS score of 7.0 indicates a high‑severity local privilege escalation. EPSS is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires local execution privileges that any authenticated user with access to the UDFS interface could obtain. Because it is a use‑after‑free, the attack vector is likely a local privilege escalation scenario rather than remote exploitation. The lack of an EPSS score suggests current exploitation activity is low, but the high severity warrants prompt mitigation.