CVE-2026-40404 — Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Executive Summary

None

Overview

7.8

CVSS HIGH

Important

MS Severity

Not Exploited

MS Exploit Status

Less Likely

MS Exploit Likelihood

Category Elevation of Privilege

Weakness CWE-122: Heap-based Buffer Overflow

Released Jun 9 2026

Last Updated Jun 9 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

EPSS Score 0.00339 — 0.26694 percentile

NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

ATTACK VECTOR

Local

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

Low

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

High

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 6.8

EPSS Score

0.00339

probability of exploitation in the next 30 days

0.26694 percentile - updated 2026-08-14

View on FIRST.org

Affected Products

30 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1607 for 32-bit Systems	`5094122 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1607 for x64-based Systems	`5094122 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for 32-bit Systems	`5094123 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 1809 for x64-based Systems	`5094123 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5094127 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5094127 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 21H2 for x64-based Systems	`5094127 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5094127 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5094127 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 10 Version 22H2 for x64-based Systems	`5094127 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for ARM64-based Systems	`5093998 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 23H2 for x64-based Systems	`5093998 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for ARM64-based Systems	`5094126 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 24H2 for x64-based Systems	`5094126 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for ARM64-based Systems	`5094126 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 25H2 for x64-based Systems	`5094126 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 Version 26H1 for ARM64-based Systems	`5095051 (Security Update)`	Important	Elevation of Privilege	Yes
Windows 11 version 26H1 for x64-based Systems	`5095051 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2012	`5094042 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2012 (Server Core installation)	`5094042 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2012 R2	`5094041 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2012 R2 (Server Core installation)	`5094041 (Monthly Rollup)`	Important	Elevation of Privilege	Yes
Windows Server 2016	`5094122 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2016 (Server Core installation)	`5094122 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019	`5094123 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2019 (Server Core installation)	`5094123 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022	`5094128 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2022 (Server Core installation)	`5094128 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025	`5094125 (Security Update)`	Important	Elevation of Privilege	Yes
Windows Server 2025 (Server Core installation)	`5094125 (Security Update)`	Important	Elevation of Privilege	Yes

Patches

10 patches

Article	Type	Restart
`5094122`	Security Update	Yes
`5094123`	Security Update	Yes
`5094127`	Security Update	Yes
`5093998`	Security Update	Yes
`5094126`	Security Update	Yes
`5095051`	Security Update	Yes
`5094042`	Monthly Rollup	Yes
`5094041`	Monthly Rollup	Yes
`5094128`	Security Update	Yes
`5094125`	Security Update	Yes

Patch Diff

ghidriff · udfs.sys (KB5094126)

Numeric-truncation heap overflow (CWE-197 -> CWE-122) in udfs.sys UdfInitializeAllocations, local EoP via a crafted UDF image (.iso/.img/UDF VHD). The function parses Allocation Descriptors and file-size info while mounting, summing AD lengths and converting to block/sector units by right-shifting Vcb->LBSizeShift (Vcb+0x48) and using the result as a 32-bit VBN/sector count. PRE: the AD-length sum and file size can exceed 32 bits but were used as 32-bit without an upper-bound check, so the high bits truncate (mov edx,edx) and a too-small VBN/sector count is produced; it flows into FsRtlAddLargeMcbEntry / disk-I/O sector counts, so the extent/pool buffer/bitmap is under-mapped while real-size I/O writes past the end -> heap/pool overflow. Diff of udfs.sys 10.0.26100.8521 -> .8655 (Jun 9 2026, KB5094126) confirms the fix: gated behind CFR flag Feature_2146947386, before ScbMcb init if file size (Scb+0x20) > 0xFFFFFFFF<<LBSizeShift -> UdfRaiseStatusEx(0xC0000102 STATUS_DISK_CORRUPT_ERROR); and after accumulating v5 += ad_len & 0x3FFFFFFF, if v5 > 0xFFFFFFFF<<LBSizeShift abort likewise. The same gate was applied across 6 functions on the mount/write/SetEOF paths. Note: our diff shows Feature_2146947386 (build/arch); the 0xFFFFFFFF<<LBSizeShift bound is as described.

Pre-patch version 10.0.26100.8521 Download

Post-patch version 10.0.26100.8655 Download

Function	Address	Change	Note
`UdfInitializeAllocations`	`code change`	code (32-bit VBN range guard, CFR-gated)	Post (Feature_2146947386): if 0xffffffffL<<(LBSizeShift&0x3f) < (u64)(Scb+0x20) -> UdfRaiseStatusEx(0xC0000102); and after v5 += ad_len&0x3FFFFFFF the same bound check. Pre: no upper-bound; shifted 64-bit sum/size truncated into a 32-bit VBN/sector count.
`Feature_2146947386`	`gate`	added (CFR gate)	CFR flag gating the 0xFFFFFFFF<<LBSizeShift bound on the AD-length sum and file size; applied across 6 mount/write/SetEOF functions.

View full diff report View RCA report

Attack Path

A crafted UDF image's oversized allocation-descriptor sum truncates to a small 32-bit VBN, under-mapping the extent so real-size I/O overflows the pool

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

No known exploits have been linked for this CVE yet. When available, exploit references will be sourced from public repositories and may be unverified, incomplete, or non-functional. Always review code carefully before use in any environment.

Acknowledgments

R4nger with Kunlun Lab & Zhiniang Peng with HUST

References

MSRC Advisory MITRE NVD