Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-97787

Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability

En bref

Sévérité
HIGH 7.0
EPSS
EPSS 0.21 % · centile 12 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
microsoft
Statut NVD
Analyzed

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Cmicrosoft
CVSS 3.1HIGH 7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · secure@microsoft.com (Secondary)

Faiblesses (CWE)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Microsoft · Windows 11 version 23H2affected 10.0.22631.0 < 10.0.22631.7652
Microsoft · Windows 11 Version 23H2affected 10.0.22631.0 < 10.0.22631.7652
Microsoft · Windows 11 Version 24H2affected 10.0.26100.0 < 10.0.26100.9711
Microsoft · Windows 11 Version 25H2affected 10.0.26200.0 < 10.0.26200.9711
Microsoft · Windows 11 version 26H1affected 10.0.28000.0 < 10.0.28000.3231
Microsoft · Windows 11 Version 26H2affected 10.0.26300.0 < 10.0.26300.9711
Microsoft · Windows Server 2022affected 10.0.20348.0 < 10.0.20348.5761
Microsoft · Windows Server 2025affected 10.0.26100.0 < 10.0.26100.33650
Microsoft · Windows Server 2025 (Server Core installation)affected 10.0.26100.0 < 10.0.26100.33650

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD