CVE-2026-40409 - Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Back Back to CVE browser

HIGH

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Published Jun 9, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.33%

Description

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Affected products

Vendor Microsoft Product Windows 10 Version 1607 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.9234
Vendor Microsoft Product Windows 10 Version 1809 Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.8880
Vendor Microsoft Product Windows 10 Version 21H2 Default
n/a
- Version
  10.0.19044.0
  Status
  affected
  Constraints
  <10.0.19044.7417
Vendor Microsoft Product Windows 10 Version 22H2 Default
n/a
- Version
  10.0.19045.0
  Status
  affected
  Constraints
  <10.0.19045.7417
Vendor Microsoft Product Windows 11 Version 23H2 Default
n/a
- Version
  10.0.22631.0
  Status
  affected
  Constraints
  <10.0.22631.7219
Vendor Microsoft Product Windows 11 Version 24H2 Default
n/a
- Version
  10.0.26100.0
  Status
  affected
  Constraints
  <10.0.26100.8655
Vendor Microsoft Product Windows 11 Version 25H2 Default
n/a
- Version
  10.0.26200.0
  Status
  affected
  Constraints
  <10.0.26200.8655
Vendor Microsoft Product Windows 11 version 23H2 Default
n/a
- Version
  10.0.22631.0
  Status
  affected
  Constraints
  <10.0.22631.7219
Vendor Microsoft Product Windows 11 version 26H1 Default
n/a
- Version
  10.0.28000.0
  Status
  affected
  Constraints
  <10.0.28000.2269
Vendor Microsoft Product Windows Server 2012 Default
n/a
- Version
  6.2.9200.0
  Status
  affected
  Constraints
  <6.2.9200.26132
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
n/a
- Version
  6.2.9200.0
  Status
  affected
  Constraints
  <6.2.9200.26132
Vendor Microsoft Product Windows Server 2012 R2 Default
n/a
- Version
  6.3.9600.0
  Status
  affected
  Constraints
  <6.3.9600.23228
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
n/a
- Version
  6.3.9600.0
  Status
  affected
  Constraints
  <6.3.9600.23228
Vendor Microsoft Product Windows Server 2016 Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.9234
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
n/a
- Version
  10.0.14393.0
  Status
  affected
  Constraints
  <10.0.14393.9234
Vendor Microsoft Product Windows Server 2019 Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.8880
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
n/a
- Version
  10.0.17763.0
  Status
  affected
  Constraints
  <10.0.17763.8880
Vendor Microsoft Product Windows Server 2022 Default
n/a
- Version
  10.0.20348.0
  Status
  affected
  Constraints
  <10.0.20348.5256
Vendor Microsoft Product Windows Server 2025 Default
n/a
- Version
  10.0.26100.0
  Status
  affected
  Constraints
  <10.0.26100.32995
Vendor Microsoft Product Windows Server 2025 (Server Core installation) Default
n/a
- Version
  10.0.26100.0
  Status
  affected
  Constraints
  <10.0.26100.32995

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Windows 10 Version 1607

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.9234

Microsoft

Windows 10 Version 1809

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.8880

Microsoft

Windows 10 Version 21H2

n/a

Version	Status	Constraints
10.0.19044.0	affected	<10.0.19044.7417

Microsoft

Windows 10 Version 22H2

n/a

Version	Status	Constraints
10.0.19045.0	affected	<10.0.19045.7417

Microsoft

Windows 11 Version 23H2

n/a

Version	Status	Constraints
10.0.22631.0	affected	<10.0.22631.7219

Microsoft

Windows 11 Version 24H2

n/a

Version	Status	Constraints
10.0.26100.0	affected	<10.0.26100.8655

Microsoft

Windows 11 Version 25H2

n/a

Version	Status	Constraints
10.0.26200.0	affected	<10.0.26200.8655

Microsoft

Windows 11 version 23H2

n/a

Version	Status	Constraints
10.0.22631.0	affected	<10.0.22631.7219

Microsoft

Windows 11 version 26H1

n/a

Version	Status	Constraints
10.0.28000.0	affected	<10.0.28000.2269

Microsoft

Windows Server 2012

n/a

Version	Status	Constraints
6.2.9200.0	affected	<6.2.9200.26132

Microsoft

Windows Server 2012 (Server Core installation)

n/a

Version	Status	Constraints
6.2.9200.0	affected	<6.2.9200.26132

Microsoft

Windows Server 2012 R2

n/a

Version	Status	Constraints
6.3.9600.0	affected	<6.3.9600.23228

Microsoft

Windows Server 2012 R2 (Server Core installation)

n/a

Version	Status	Constraints
6.3.9600.0	affected	<6.3.9600.23228

Microsoft

Windows Server 2016

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.9234

Microsoft

Windows Server 2016 (Server Core installation)

n/a

Version	Status	Constraints
10.0.14393.0	affected	<10.0.14393.9234

Microsoft

Windows Server 2019

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.8880

Microsoft

Windows Server 2019 (Server Core installation)

n/a

Version	Status	Constraints
10.0.17763.0	affected	<10.0.17763.8880

Microsoft

Windows Server 2022

n/a

Version	Status	Constraints
10.0.20348.0	affected	<10.0.20348.5256

Microsoft

Windows Server 2025

n/a

Version	Status	Constraints
10.0.26100.0	affected	<10.0.26100.32995

Microsoft

Windows Server 2025 (Server Core installation)

n/a

Version	Status	Constraints
10.0.26100.0	affected	<10.0.26100.32995

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-197

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40409
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40409		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Jun 9, 2026

Updated Sep 24, 2026

Reserved Apr 13, 2026

Link CVE-2026-40409

CISA Vulnrichment

Updated Jun 10, 2026

NVD

Status Analyzed

Modified Jul 23, 2026

Link CVE-2026-40409

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-40409