Windows Bind Filter EUVD-2026-99422

Requires the attacker to already have a local, authenticated low-privileged session (PR:L) on an affected host - Windows 11 Version 23H2 (builds before 10.0.22631.7652) or Windows Server 2025 including Server Core (builds before 10.0.26100.33650). Exploitation targets the Windows Bind Filter Driver (bindflt), which is present by default, so no non-default feature toggle is indicated by the available data. Limiting factors: the attack vector is strictly local (no remote/network path), there is no user interaction, and the attacker needs valid local access first; SSVC rates the issue non-automatable, so it cannot be opportunistically mass-exploited.

This is a credible, high-priority local privilege-escalation issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 8.8) describes a low-complexity, no-interaction attack requiring only low existing privileges that yields total compromise with a scope change - consistent with a kernel-mode driver flaw (CWE-863, improper authorization). CISA SSVC reinforces the impact side (Technical Impact: total) but tempers urgency on the exploitation side: Exploitation is rated 'none' (no observed exploitation) and Automatable is 'no', which fits a local-only EoP that cannot be sprayed remotely. The CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The combined signals point to a serious post-compromise escalation primitive - valuable to an attacker who already has a foothold - but not an immediate wormable or internet-facing emergency. Note a signal to verify: the 'Authentication Bypass' tag conflicts with the actual CWE-863/privilege-elevation nature of the flaw (an authorization, not authentication, defect) - treat the tag with caution.

An attacker who already holds low-privileged access on a Windows 11 23H2 or Windows Server 2025 host (e.g., via phishing, a standard user account, or a compromised service) invokes the Bind Filter Driver through its local interface and abuses the improper access-control check to execute code or manipulate objects at SYSTEM/kernel privilege. No user interaction is required and attack complexity is low, but the attacker must first obtain an initial local foothold. No public exploit code was identified at time of analysis.