Windows Container Isolation CVE-2026-72971

Exploitation requires a locally authenticated session with at least low-privilege (standard user) rights on the target Windows 11 26H1 system. The Windows Container Isolation feature - specifically the unionfs.sys FS Filter Driver - must be present and operational, which is the case on any Windows 11 26H1 installation where Windows Sandbox or container support is enabled. The attacker must be able to create symbolic or hard links on the local filesystem. Exploitation is NOT automatable remotely: the CVSS vector is AV:L (local access mandatory) and SSVC confirms the attack is not automatable. Exploitation is limited to Windows 11 version 26H1 builds below 10.0.28000.2704; other Windows versions are not listed as affected.

The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects a moderate local tampering risk: attack complexity is low, but exploitation is confined to the local machine and requires at least a low-privilege authenticated session. The SSVC assessment reinforces this - exploitation status is none, the vulnerability is not automatable (it requires deliberate local interaction), and technical impact is rated partial. No active exploitation is confirmed and no public proof-of-concept has been identified at time of analysis. Real-world priority is therefore low unless the affected systems are multi-tenant environments where container isolation is a critical security boundary (e.g., shared developer workstations or cloud-hosted Windows sandbox deployments). A notable discrepancy exists in the source data: the intelligence tags label this 'Information Disclosure', yet both the CVE description ('tampering') and the CVSS impact metrics (C:N/I:H/A:N - no confidentiality loss, high integrity loss) consistently indicate a file integrity/tampering impact, not confidentiality exposure. The 'Information Disclosure' tag appears to be a misclassification and should not be relied upon.

A locally authenticated low-privilege user on a Windows 11 26H1 system plants a symbolic link in a location that the Container Isolation FS Filter Driver (unionfs.sys) will traverse during a file operation. When the driver processes the link without resolving it to its true target, the attacker's crafted path redirects the write or modify operation to an arbitrary file on the host filesystem, allowing them to corrupt or overwrite files they would not ordinarily have write access to. No public proof-of-concept has been identified, but the technique is well-understood within the CWE-59 class.