CVE-2026-49790

What it actually does

This is a local elevation-of-privilege vulnerability in the Windows Universal Disk Format File System driver, which handles UDF-formatted media such as optical discs and some disk images. A low-privileged attacker who can convince a user to interact with specially crafted UDF content may trigger unsafe behavior in the kernel-mode file system driver. Successful exploitation can allow the attacker to execute code with elevated privileges, potentially reaching SYSTEM-level control and gaining full confidentiality, integrity, and availability impact on the affected Windows host.

Why it matters to the business

If exploited, an attacker who already has limited access or can persuade a user to open malicious removable media or a disk image could take full control of a Windows workstation or server. This can enable credential theft, disabling of security tools, data tampering, lateral movement, ransomware preparation, or persistence. The issue affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2012 through 2025, so organizations with broad Windows fleets should treat patch coverage as important even though there is currently no known public exploit maturity, no CISA KEV listing, and low EPSS likelihood at this time.

How an attack unfolds

An attacker first obtains low-privileged local access to a Windows system or delivers crafted UDF-formatted content to a target user, such as through a malicious ISO, virtual disk, removable device, or optical-media-style image. The victim must interact with or mount the crafted content, satisfying the user-interaction requirement. When Windows processes the malicious UDF file system metadata through the UDFS kernel driver, the vulnerability is triggered. The attacker then leverages the resulting kernel-mode condition to escalate from a normal user context to elevated privileges. After elevation, the attacker can run privileged commands, dump credentials, disable controls, install persistence, or use the compromised host as a pivot point.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-49790 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No specific fixed build numbers were provided in the input, so remediation should be validated against Microsoft Update, WSUS, Microsoft Update Catalog, or enterprise patch-management compliance data for the July 2026 or later cumulative security update containing the UDFS fix. Where immediate patching is not possible, reduce exposure by restricting the use of untrusted removable media and disk images, limiting the ability of standard users to mount images where feasible, blocking unsolicited ISO/UDF attachments at email and web gateways, and enforcing least privilege. These mitigations reduce exploitation opportunity but should not be considered a replacement for applying the vendor fix.

How to confirm the fix worked

Confirm that affected Windows endpoints and servers have installed the Microsoft cumulative security update that includes the UDFS driver fix. Validate through Windows Update history, WSUS or endpoint-management compliance reports, installed hotfix inventory, and file-version checks for the Windows UDFS driver where Microsoft documents the patched version. Test representative systems by confirming they are no longer reported as vulnerable by authenticated vulnerability scanning. Also review endpoint policy to ensure untrusted disk-image and removable-media handling controls are working, including restrictions on mounting files from email, browser downloads, and removable devices where those controls are required.

Typical attack path

1. Gain low-privileged access to an affected Windows host or deliver crafted UDF content to a target user.
2. Prepare a malicious UDF-formatted disk image, removable media, or file system container designed to trigger the UDFS driver flaw.
3. Convince the user to mount, open, browse, or otherwise interact with the crafted UDF content.
4. Trigger vulnerable parsing or handling inside the Windows UDFS kernel driver.
5. Escalate privileges from a low-privileged account to an elevated or SYSTEM-level context.
6. Use elevated access to run privileged tooling, access sensitive files, tamper with security controls, steal credentials, or move laterally.

How to detect it

To determine whether exploitation may already have occurred, focus on evidence of suspicious UDF, ISO, optical-media, or removable-media handling followed closely by privilege-escalation or post-exploitation activity. Review Windows Security logs for unusual logons, privilege assignment, process creation, service creation, scheduled task creation, and administrative activity shortly after disk-image or removable-media use. Useful sources include Windows Security events, Sysmon, Microsoft Defender for Endpoint, EDR telemetry, PowerShell logs, Shell-Core and MountMgr-related operational logs where enabled, removable-storage auditing, email/web gateway logs for delivered disk images, and file-system artifacts showing mounted images or recently accessed media. Hunt for low-privileged users spawning unexpected elevated processes, new services or drivers, LSASS access, credential-dumping behavior, security-control tampering, or lateral movement shortly after interaction with ISO/UDF/removable-media content. Because public exploit details and stable exploit-specific artifacts are not indicated, detection should be behavior-based rather than relying only on static signatures.

• udfs.sys
• \SystemRoot\System32\drivers\udfs.sys
• C:\Windows\System32\drivers\udfs.sys
• Mount-DiskImage
• Dismount-DiskImage
• .iso
• .udf
• Microsoft-Windows-DriverFrameworks-UserMode
• Microsoft-Windows-Kernel-PnP
• Microsoft-Windows-Partition/Diagnostic
• Microsoft-Windows-Storage-ClassPnP
• Microsoft-Windows-Shell-Core
• Event ID 7045
• Event ID 4688
• Event ID 4672
• Event ID 4697
• Event ID 4698
• Event ID 1
• Event ID 6
• Event ID 7
• Event ID 10
• Event ID 11

What your security team should do

• Prioritize deployment of the relevant Microsoft security update across Windows servers and high-risk workstations, especially systems used by administrators, developers, help desks, and users likely to handle external media or disk images.
• Use authenticated vulnerability scanning and patch-management reporting to identify all affected Windows 10, Windows 11, and Windows Server assets that are missing the relevant cumulative update.
• Temporarily restrict or monitor mounting of ISO, UDF, virtual disk, and removable-media content from untrusted sources until patch coverage is complete.
• Harden email and web controls to block or detonate unsolicited disk-image attachments and downloads, especially ISO or optical-media-style payloads.
• Monitor for suspicious disk-image mounting followed by privilege-escalation behavior, such as new SYSTEM-level processes, credential-dumping tools, driver/service installation, or security-tool tampering.
• Ensure standard users do not have unnecessary local administrator rights so that exploitation opportunities and post-exploitation impact are reduced.
• Because this is not currently listed in CISA KEV, has no known exploit maturity, and has low EPSS, balance urgency against active-exploitation risks, but do not defer patching indefinitely due to the broad Windows footprint and high local impact.