# CVE-2026-23672 — Windows UDFS `udfs.sys` Missing Negative-Value Validation in `UdfCommonSetInfo` / `UdfSetEndOfFileInfo` / `UdfSetAllocationInfo` → OOB Read

---

## Summary

| | |
|---|---|
| **Product** | Windows — `udfs.sys` (Universal Disk Format File System driver) |
| **CVE ID** | CVE-2026-23672 |
| **Impact** | Elevation of Privilege |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-125: Out-of-bounds Read |
| **Delivery** | Local — signed 64-bit file position / EOF / allocation size passed from user mode |
| **KB / Fixed build** | KB5079473 — `udfs.sys` 10.0.26100.8037 (Win11 24H2 x64) |
| **Patch Date** | March 10, 2026 (2026-Mar) |
| **Pre-patch binary (no check)** | `udfs.sys` 10.0.26100.4652 — SHA256 `e59b37291154485d953be7e0822cfab8769a15e6586a0cacb4ce53ce55ad8ca8` |
| **Post-patch binary (check present)** | `udfs.sys` 10.0.26100.8036 — SHA256 `b5a65e7991f3fedbd3547edf494c0dd9b7eafcd53011d90a7b2bc265341c705a` |
| **Feature flag** | `Feature_3887279419` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`udfs.sys` is the Windows UDF (Universal Disk Format, optical/DVD) file-system
driver. Its `FileInformation` set-handlers accept file **position**, **end-of-file**
and **allocation size** values from user mode. These are **signed 64-bit
integers** (`_LARGE_INTEGER`), so a caller can supply negative values.

---

## Vulnerability Summary

The three set-info handlers did **not validate that the caller-supplied 64-bit
value is non-negative**. A negative position/EOF/allocation value passed the
existing class checks and reached size/offset arithmetic in the kernel, where it
was treated as a very large or wrapped magnitude — driving an **out-of-bounds
read** (CWE-125). The affected classes:

- **Position** (`UdfCommonSetInfo` — `FilePositionInformation`): sets
  `FileObject->CurrentByteOffset.QuadPart` from the user value.
- **End-of-file** (`UdfSetEndOfFileInfo`, class `0x934`).
- **Allocation** (`UdfSetAllocationInfo`, class `2356`).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): a caller issues a
  `NtSetInformationFile` request on a UDFS file with a negative 64-bit
  position/EOF/allocation value.
- The negative value is interpreted as an out-of-range offset/size in kernel,
  producing an OOB read.

---

## Vulnerability Details

### Root Cause

Signed 64-bit file-position / EOF / allocation values from user mode were used in
kernel size/offset logic without a `>= 0` check, so a negative value bypassed the
intended range and drove an out-of-bounds read.

### The patch (confirmed — diff, .4652 → .8036; enabled in .8037)

A **`value >= 0`** check is added to all three information classes, gated behind
`Feature_3887279419`; negative values now return **`STATUS_INVALID_PARAMETER`
(`0xC000000D`)**:

```c
// UdfSetAllocationInfo (patched) — from our diff
if ( v9 != 2356
  || (Feature_3887279419__private_IsEnabledDeviceUsage() && a5->QuadPart < 0) )   // *** negative -> reject ***
    return 0xC000000D;   // STATUS_INVALID_PARAMETER

// UdfSetEndOfFileInfo (patched)
if ( v9 != 0x934
  || (Feature_3887279419__private_IsEnabledDeviceUsage() && a5->QuadPart < 0) )
    return 0xC000000D;

// UdfCommonSetInfo (patched, FilePositionInformation)
v22 = Feature_3887279419__private_IsEnabledDeviceUsage() == 0;
v23 = *p_Type;
if ( v22 || v23 >= 0 )                                   // *** only accept non-negative position ***
    FileObject->CurrentByteOffset.QuadPart = v23;
// else -> STATUS_INVALID_PARAMETER
```

Our diff of `udfs.sys` 10.0.26100.4652 (no check) → .8036 confirms the three
functions gain the `Feature_3887279419`-gated negative-value rejection (added
`return 0xC000000D` paths). The build pair `.8036 → .8328` shows no change because
the gated code was already present in .8036; the March KB5079473 (.8037) is when
the protection ships enabled.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3887279419`.** The `>= 0` validation runs only when the
flag is enabled; the original unchecked path still ships when disabled. Verify
`Feature_3887279419` is enabled to confirm the negative-value rejection is live.

---

## Detection Guidance

**Behavioural.** `NtSetInformationFile` on UDFS files with negative
position/EOF/allocation values; UDFS returning `STATUS_INVALID_PARAMETER` for such
requests once the fix is active.

**Crash signature.** OOB-read / pool-read faults in `udfs!UdfSetAllocationInfo` /
`UdfSetEndOfFileInfo` / `UdfCommonSetInfo` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_3887279419` is enabled.

---

## References

- MSRC advisory — CVE-2026-23672 (Windows UDFS Elevation of Privilege), released 2026-03-10, KB5079473.
- Full binary diff: `/data/patch_diffs/udfs_sys-cve-2026-23672-ghidriff.md`