EUVD-2026-56379
GHSA-3j6j-6h9p-2vrq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector with low-privilege requirement matches a kernel driver LPE; no scope change as impact is confined to the local system.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authenticated local attacker to gain SYSTEM-level privileges on affected Windows 11 26H1 systems. The vulnerability is a heap-based buffer overflow in the kernel driver, exploitable by a low-privileged user without any user interaction. No public exploit has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Technical ContextAI
The affected component is unionfs.sys, the Windows Container Isolation FS Filter Driver - a kernel-mode driver supporting filesystem virtualization used by Windows containers (e.g., Docker on Windows, Windows Sandbox). CWE-122 (Heap-based Buffer Overflow) indicates that attacker-controlled data causes a write beyond the bounds of a heap-allocated buffer within the driver. Because this executes in kernel context, a successful overflow can corrupt adjacent kernel memory structures, enabling arbitrary code execution at the kernel privilege level. Affected versions are Windows 11 26H1, specifically builds 10.0.28000.0 through 10.0.28000.2703.
RemediationAI
Apply the Microsoft-released patch bringing Windows 11 26H1 to build 10.0.28000.2704 or later via Windows Update or WSUS; the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62772 provides patch details. If immediate patching is not feasible, a targeted workaround is to restrict or disable the Windows Container Isolation feature on hosts where it is not operationally required - this removes the vulnerable attack surface entirely, though it will break Windows Sandbox and Windows container workloads. On systems where containers must remain active, limit local interactive and remote desktop access to trusted administrator accounts only, reducing the pool of principals who could trigger the vulnerable code path.
More in Windows 11 26h1
View allSymlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Remote code execution in Microsoft Windows HTTP.sys allows unauthenticated network attackers to execute arbitrary code b
Privilege elevation in the Windows TCP/IP networking stack allows an unauthenticated attacker on an adjacent network to
Remote code execution in Windows RRAS affects Windows 10 1607 and Windows Server 2022 23h2 through an integer overflow v
Local code execution in Microsoft Windows Win32K GRFX (graphics) subsystem allows an attacker with low-privilege local a
Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an
Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to high
Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) in conc
Remote denial-of-service in Microsoft's HTTP/2 implementation allows unauthenticated network attackers to exhaust server
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today