A null pointer dereference in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker who has local, authorized access to the system to execute arbitrary code. By triggering this flaw the attacker can gain the same privileges as the user context in which the code runs, potentially affecting confidentiality, integrity, and availability of the local machine. The vulnerability is identified as CWE-476.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). All stated builds across these editions are impacted.

The CVSS score of 7.8 indicates a high severity of the vulnerability. No EPSS score is available, so the exact likelihood of exploitation cannot be quantified; however, the attack requires a local, authorized user who can initiate a UDFS mount operation. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed external exploitation to date, but the high CVSS and local execution potential still warrant prompt remediation.