An authorized local attacker can trigger a use‑after‑free bug in the Windows Container Isolation FS Filter Driver. By performing a sequence of file operations within a container, the attacker may cause the driver to execute arbitrary code with system privilege. This elevates the attacker to system level access, allowing full control of the host operating system. The vulnerability is a classic use‑after‑free flaw (CWE‑416). The primary impact is privilege escalation, compromising confidentiality, integrity, and availability of the affected system.

The flaw affects a broad range of Microsoft Windows releases. Client builds include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1. Server editions such as Windows Server 2016 (including Server Core), Windows Server 2019 (Server Core), Windows Server 2022, Windows Server 2025, and the upcoming Windows Server 23H2 are also impacted. All affected versions list the Container Isolation FS Filter Driver as part of the core OS. Administrators should review the list of affected builds when planning mitigations.

With a CVSS score of 7.8 the vulnerability is considered high severity. Mechanisms to exploit it require local access to a container or the ability to perform privileged file operations, so it is not remotely exploitable by unauthenticated attackers. No EPSS score is available, and the flaw is not in the CISA KEV catalog. Because it grants full system privileges, the potential lateral movement within an infrastructure is significant. The risk remains elevated until the associated security update is applied.