Windows Bind Filter Driver CVE-2026-61927

The attacker must have a low-privileged local authenticated session on the target Windows system (PR:L confirmed by CVSS vector). The attack is local-only (AV:L); remote network-based exploitation is not possible without a prior foothold. High attack complexity (AC:H) means the race condition must be won, requiring precise thread timing and likely repeated attempts - exploitation is not a single deterministic operation. The vulnerability is present on default installations of the affected Windows builds where bindflt.sys is loaded; no special non-default configuration is required to be vulnerable, but the driver is primarily exercised by container and sandbox workloads. What limits exploitation: (1) attacker must already have local code execution as a standard user, (2) race conditions are timing-dependent and may cause system instability on failure, and (3) modern Windows mitigations such as kernel CFG and SMEP raise the bar for turning a use-after-free into reliable code execution.

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0) accurately reflects a locally-triggered, high-complexity attack that nonetheless yields full CIA impact at the kernel level. The AC:H rating is significant: race condition exploitation requires precise thread timing and repeated attempts, raising the bar compared to deterministic local privilege escalation bugs. No EPSS score was provided in the input data and no CISA KEV listing is present, meaning no confirmed active exploitation or broad weaponization is known at this time. The 'Denial Of Service' tag alongside 'Race Condition' suggests that even failed exploitation attempts may crash the driver or destabilize the system. The real-world risk is moderate-to-high for environments where untrusted local users exist (shared workstations, VDI, multi-tenant servers, Citrix/RDS), but negligible in single-user or fully managed enterprise endpoints where local code execution by non-admins is already blocked by policy. The absence of EPSS and KEV data means exploitation likelihood cannot be quantified beyond the CVSS complexity signal.

An attacker who has already obtained a low-privileged local account - through phishing, credential theft, or exploitation of another vulnerability - races two concurrent threads against the Bind Filter Driver to free and then re-access a kernel object before it is invalidated. By winning the race and controlling the dangling pointer, the attacker overwrites a kernel data structure to redirect execution into attacker-controlled code, ultimately obtaining SYSTEM privileges and full control of the host. No public proof-of-concept code is known at time of analysis, but the high AC:H rating indicates reliable exploitation requires multiple attempts or a finely tuned thread scheduling primitive.