Windows Bind Filter CVE-2026-70274

Requires local, pre-authenticated access: the attacker must already be able to run code as a low-privileged user on the target host (CVSS PR:L, AV:L) and reach the Windows Bind Filter Driver (bindflt.sys) to trigger the use-after-free. No remote network vector and no user interaction are involved (UI:N), which both lowers complexity for an attacker already on the box and limits reach to those who have first achieved initial access. Limiting factors: this is a post-compromise escalation step, not a remote entry point, and exploitation is confined to affected Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2025 builds below the patched versions listed in EUVD; patched builds are not exploitable.

All signals point to a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have low-privileged code execution on the host (PR:L, AV:L), but once there, exploitation is low-complexity (AC:L) with no user interaction and full confidentiality, integrity, and availability impact within the same security scope (S:U). No EPSS score was provided in the input, so exploitation-probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public POC is referenced, so this is 'no public exploit identified at time of analysis.' The reporter is Microsoft itself (secure@microsoft.com), consistent with internal/coordinated discovery rather than observed in-the-wild abuse. A vendor patch is available. There is no conflict between the CVSS vector and the description - both agree this is local, authenticated privilege escalation. The main caveat is a tag inconsistency: the input carries a 'Denial Of Service' tag, yet the description and CVSS (C:H/I:H/A:H, EoP) describe privilege elevation, not DoS; treat the DoS label with skepticism and rely on the EoP framing. Net: a real, patch-now-in-normal-cycle local EoP primitive commonly chained after initial access, not a remotely wormable crisis.

An attacker who has already gained low-privileged code execution on a Windows host - for example via phishing, a malicious installer, or a compromised standard user account - invokes the Windows Bind Filter Driver (bindflt.sys) in a way that triggers a use-after-free, corrupting kernel memory to run code at SYSTEM. No user interaction or remote access is needed. No public exploit code is referenced at time of analysis, so this would require independent exploit development against the use-after-free condition.