CVE-2026-50498 is an out-of-bounds read vulnerability in the Windows Universal Disk Format File System Driver (UDFS) that can be used for elevation of privilege. Microsoft rates it CVSS 3.1 base 7.8 (High) with a temporal score of 6.8; the vector is local access, low attack complexity, no privileges required, but user interaction is required. The reported impact is high for confidentiality, integrity, and availability. Microsoft lists the exploit status as not publicly disclosed and not exploited, with exploit code maturity unproven. For enterprise environments, this is a high-severity local vulnerability rather than a network-exposed one, so it is most relevant where attackers can already obtain local execution or where users may interact with malicious media.

Highlights:
- CVSS scores: Base 7.8 - Temporal 6.8
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege with HIGH confidentiality, HIGH integrity, and HIGH availability impacts.
- Exploitation likelihood: Exploitation Less Likely; vector is LOCAL, attack complexity is LOW, privileges required are NONE, and user interaction is REQUIRED.
- Severity for enterprise: High technical severity, but lower exposure than remote vulnerabilities because exploitation is local and requires user interaction.
- Patch status: available

Affected systems:
- Windows 10 1607
- Windows 10 1809
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025