AI description
CVE-2026-85909 is an information disclosure vulnerability affecting the Windows Universal Disk Format File System Driver (UDFS). Addressed as part of Microsoft's October 2026 Patch Tuesday, the vulnerability is caused by an out-of-bounds read flaw within the driver. This flaw allows an authorized, local attacker to read memory outside of the intended buffer, which can result in the exposure of local system information. The vulnerability impacts a broad range of Microsoft operating systems, including multiple versions of Windows 10, Windows 11, and Windows Server editions from Server 2012 through Server 2025. Microsoft has released corresponding security updates and patches to resolve the issue across all affected platforms.
- Description
- Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
- Source
- secure@microsoft.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 5.5
- Impact score
- 3.6
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity
- MEDIUM
- secure@microsoft.com
- CWE-822
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
8