MicrosoftCVE-2026-62699

Microsoft Windows: null pointer dereference

CVE-2026-62699 · Published Aug 11, 2026 · updated Sep 25, 2026

Medium6.8

Fix: upgrade to 10.0.14393.9418 or later (10 fixed versions below)

Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.

Affected versions

Package	Affected	Fixed in
Windows 10 Version 1607 Product	>= 10.0.14393.0, < 10.0.14393.9418	10.0.14393.9418
Windows 10 Version 1809 Product	>= 10.0.17763.0, < 10.0.17763.9121	10.0.17763.9121
Windows 10 Version 21H2 Product	>= 10.0.19044.0, < 10.0.19044.7663	10.0.19044.7663
Windows 10 Version 22H2 Product	>= 10.0.19045.0, < 10.0.19045.7663	10.0.19045.7663
Windows 11 Version 23H2 Product	>= 10.0.22631.0, < 10.0.22631.7517	10.0.22631.7517
Windows 11 Version 24H2 Product	>= 10.0.26100.0, < 10.0.26100.9168	10.0.26100.9168
Windows 11 Version 25H2 Product	>= 10.0.26200.0, < 10.0.26200.9168	10.0.26200.9168
Windows 11 version 23H2 Product	>= 10.0.22631.0, < 10.0.22631.7517	10.0.22631.7517
Windows 11 version 26H1 Product	>= 10.0.28000.0, < 10.0.28000.2704	10.0.28000.2704
Windows Server 2012 Product	>= 6.2.9200.0, < 6.2.9200.26280	6.2.9200.26280
Windows Server 2012 (Server Core installation) Product	>= 6.2.9200.0, < 6.2.9200.26280	6.2.9200.26280
Windows Server 2012 R2 Product	>= 6.3.9600.0, < 6.3.9600.23338	6.3.9600.23338

Details and references