CVE-2026-40409: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Synopsis

This is a local privilege escalation vulnerability in the Windows Universal Disk Format File System Driver (UDFS), a kernel-mode component that handles UDF-formatted optical media and disk images. The attacker must already have a local shell or process on the target host but does not need administrator rights; a standard low-privilege account is sufficient to trigger the flaw. Successful exploitation gives the attacker full control of the affected system, covering confidentiality, integrity, and availability. A patched-image rebuild at the applicable fix versions is available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure of the vulnerable component is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation; no administrator or elevated credentials are needed.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker can trigger the vulnerability entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or other environmental dependencies.

Blast Radius

• A successful attacker gains kernel-level code execution and can read any file or credential material on the host, including secrets accessible only to SYSTEM.
• The attacker can modify, delete, or overwrite any file and system configuration on the host, including security policy and audit logs.
• The attacker can crash, halt, or destabilize the operating system and any services running on it.
• Container workloads sharing the host kernel are exposed if the underlying Windows host OS is compromised at this level.