Bind Filter Driver CVE-2026-88168

Exploitation requires the attacker to already hold authenticated, low-privileged local code execution on the target Windows system (CVSS PR:L, AV:L) - there is no remote or network-facing vector and no user interaction is needed (UI:N). The vulnerable component is the Windows Bind Filter Driver (BindFlt), a kernel-mode component present by default across supported Windows client and server editions, so no non-default feature toggle is required; the limiting factor is the prerequisite local foothold, not any special configuration. Patched builds are enumerated per edition in the EUVD data (e.g. Windows Server 2022 fixed in 10.0.20348.5761, Windows 11 24H2 in 10.0.26100.9711, Server 2025 in 10.0.26100.33650); hosts below these build numbers are affected.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: an attacker must already have low-privileged authenticated access to the target host, after which low-complexity exploitation yields total (high C/I/A) impact - consistent with kernel-driver code execution. The signals align rather than conflict: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (LPE flaws are inherently not network-wormable), while Technical Impact is 'total', matching the C:H/I:H/A:H kernel compromise. No KEV listing and no POC are present in the input, so this is not under confirmed active exploitation. The practical risk is as a second-stage/local escalation primitive - valuable to an attacker who already has a foothold (phishing payload, compromised low-priv account, malware) but not a remote entry point on its own. For patch prioritization, treat it as a standard Patch-Tuesday-class kernel EoP: important for multi-user, terminal-server, and endpoint environments where initial-access malware is a realistic precursor, but below any internet-facing RCE.

An attacker who has already obtained low-privileged code execution on a Windows host (for example via a phishing payload or a compromised standard user account) runs a crafted exploit that sends malformed input to the Bind Filter Driver, triggering a heap-based buffer overflow in kernel memory. Successful corruption lets the attacker execute code with SYSTEM privileges, completing a local privilege escalation from standard user to full host compromise. No public exploit identified at time of analysis, and CVSS AC:L indicates exploitation would be low-complexity once code is developed.