EUVD-2026-56379
GHSA-3j6j-6h9p-2vrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local session
-
DeliveryInteract with Container Isolation FS Filter Driver
-
ExploitTrigger heap buffer overflow in unionfs.sys
-
ExecutionCorrupt kernel heap structures
-
PersistExecute arbitrary code in kernel context
-
ImpactAchieve SYSTEM privilege escalation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must have an authenticated low-privilege local session on the target Windows 11 26H1 system (PR:L per CVSS vector). The Windows Container Isolation FS Filter Driver (unionfs.sys) must be present and active - this driver is associated with Windows containers and Windows Sandbox features; systems where these features are disabled or not installed reduce exposure. No user interaction by a second party is required (UI:N). Remote unauthenticated exploitation is not possible (AV:L). The attack complexity is rated low (AC:L), suggesting no race condition or specific timing requirement beyond triggering the vulnerable code path. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local, low-complexity, low-privilege attack with full CIA impact - consistent with a kernel-mode heap overflow reachable by a normal user process. EPSS data was not provided, so exploitation probability cannot be quantified from that signal. KEV status is not confirmed, meaning active exploitation has not been verified by CISA at time of analysis. No public POC is referenced in the available data. Despite the absence of a KEV listing, a kernel LPE in a widely deployed Windows driver is a high-priority patching target: even organizations with limited security staff should treat this as urgent given the low attack complexity and full privilege gain achievable post-exploitation. The primary limiting factor is the requirement for local authenticated access - remote unauthenticated exploitation is not possible per the CVSS vector. |
| Exploit ScenarioDerived | A low-privileged local user or a process running under a limited account - such as a developer account on a Windows 11 workstation with containers enabled - crafts input that triggers the heap-based buffer overflow in unionfs.sys during a filesystem operation. The overflow corrupts kernel heap metadata or a function pointer, redirecting execution to attacker-controlled shellcode running at SYSTEM privilege. No public POC is referenced, so this scenario currently represents theoretical exploitation consistent with the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated local attacker to gain SYSTEM-level privileges on affected Windows 11 26H1 systems. The vulnerability is a heap-based buffer overflow in the kernel driver, exploitable by a low-privileged user without any user interaction. No public exploit has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
RemediationAI
Apply the Microsoft-released patch bringing Windows 11 26H1 to build 10.0.28000.2704 or later via Windows Update or WSUS; the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62772 provides patch details. If immediate patching is not feasible, a targeted workaround is to restrict or disable the Windows Container Isolation feature on hosts where it is not operationally required - this removes the vulnerable attack surface entirely, though it will break Windows Sandbox and Windows container workloads. On systems where containers must remain active, limit local interactive and remote desktop access to trusted administrator accounts only, reducing the pool of principals who could trigger the vulnerable code path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is unionfs.sys, the Windows Container Isolation FS Filter Driver - a kernel-mode driver supporting filesystem virtualization used by Windows containers (e.g., Docker on Windows, Windows Sandbox). CWE-122 (Heap-based Buffer Overflow) indicates that attacker-controlled data causes a write beyond the bounds of a heap-allocated buffer within the driver. Because this executes in kernel context, a successful overflow can corrupt adjacent kernel memory structures, enabling arbitrary code execution at the kernel privilege level. Affected versions are Windows 11 26H1, specifically builds 10.0.28000.0 through 10.0.28000.2703.
Know when Windows 11 26h1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low-privilege requirement matches a kernel driver LPE; no scope change as impact is confined to the local system.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
Executive ViewAI
CVE-2026-62772 affects Windows 11 26H1 systems with container isolation features, creating a local privilege escalation pathway to SYSTEM level. Although no public exploit is currently known, a low-privileged user or compromised account could gain full system control, enabling data theft, malware installation, or lateral movement across networked resources. Organizations running Windows 11 26H1 containerization must prioritize patching to close this escalation vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 11 26h1
View allCommand injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Remote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Exploit-DB