CVE-2026-96950: CWE-416: Use After Free in Microsoft Windows 10 Version 1607

CVE-2026-96950 is a use-after-free vulnerability (CWE-416) in the Windows Universal Disk Format File System Driver (UDFS) that affects various builds of Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges by exploiting the improper handling of memory in the UDFS driver. The vulnerability has been assigned a CVSS v3.1 base score of 7.8, indicating high severity. Microsoft has published an official fix for this vulnerability, and users are advised to apply the update to mitigate the risk.

An authorized local attacker can exploit this use-after-free vulnerability to elevate their privileges, potentially gaining higher-level access on the affected Windows 10 systems. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96950 to remediate this vulnerability.