EUVD-2026-22367Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Race condition in Microsoft AppLocker Filter Driver (applockerfltr.sys) allows local authenticated users with low privileges to elevate to SYSTEM through improper synchronization of shared resources. Affects Windows 11 (22H2 through 26H1) and Windows Server 2022/2025 editions. Vendor-released patch available as of April 2025 security updates. CVSS 7.0 reflects high attack complexity but complete system compromise if successful. No public exploit identified at time of analysis, though the local privilege escalation vector makes this valuable for post-compromise lateral movement in enterprise environments.
Technical ContextAI
AppLocker Filter Driver (applockerfltr.sys) is a kernel-mode component in Windows that enforces application control policies by intercepting executable launches and script execution. The vulnerability stems from CWE-362 (Race Condition), where concurrent execution paths access shared kernel resources without proper synchronization primitives (mutexes, semaphores, or locks). This creates a time-of-check-time-of-use (TOCTOU) window where an attacker can manipulate driver state between validation and action. As a filter driver operating at kernel level, successful exploitation grants SYSTEM-level privileges. The affected CPE strings indicate this is specific to Windows 11 builds 22H2 (22631.x), 23H2 (22631.x), 24H2 (26100.x), 25H2 (26200.x), 26H1 (28000.x), and Server 2022 23H2 (25398.x) plus Server 2025 (26100.x) across both Desktop Experience and Server Core installations.
RemediationAI
Apply Microsoft's April 2025 security updates immediately to patch the AppLocker Filter Driver race condition. Fixed versions are Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Deploy patches through Windows Update, WSUS, or Configuration Manager following standard enterprise patch management procedures. No effective workaround exists as disabling AppLocker removes security controls rather than mitigating the vulnerability. Prioritize systems where AppLocker is actively enforcing application control policies. Verify patch deployment using build number validation and monitor for unusual applockerfltr.sys driver activity through EDR telemetry during rollout window. Full advisory and deployment guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25184.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today