Windows Bind Filter EUVD-2026-99523

Exploitation requires an attacker to already have a local, authenticated foothold on the Windows host with at least low-level privileges (CVSS AV:L/PR:L) - this is not remotely reachable and needs no user interaction. The flaw resides in the Windows Bind Filter Driver (bindflt.sys), the kernel component underpinning filesystem bind/redirection mounts used by containers and features such as app execution aliases; the weakness (CWE-552, improperly-restricted file/directory access) lets the authenticated attacker read files outside their intended boundary. Limiting factors: no remote vector, required prior authentication, confidentiality-only impact (no integrity or availability loss), and unchanged scope (S:U). Hosts are affected only if running builds below the fixed versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761).

This is a moderate-severity local information disclosure flaw (CVSS 5.5) in the Windows Bind Filter Driver (bindflt), reported by Microsoft itself. All signals point to low real-world urgency despite the ubiquity of the affected platform. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires local access and existing low-level authenticated privileges, with only confidentiality impact (C:H/I:N/A:N) and no scope change. CISA's SSVC decision framework corroborates low priority: Exploitation=none (no observed activity), Automatable=no, and Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input. The signals are mutually consistent - a locally-exploitable, authenticated, confidentiality-only bug is a defense-in-depth patch rather than an emergency; the high confidentiality rating (C:H) is the only elevated metric and is tempered by the local, privileged prerequisite. Note that no EPSS probability was supplied, so quantitative exploitation likelihood cannot be cross-referenced here.

A low-privileged authenticated user already present on a Windows host abuses a path-traversal / improperly-restricted file access weakness (CWE-552) in the Bind Filter Driver to read files or directories that should be outside their access boundary, disclosing sensitive information. No public exploit code is known, and the attack requires prior local access with low privileges, so it is realistic as a post-compromise privilege/information escalation step rather than an initial intrusion vector.