Technical impact
An out of bounds read in the Windows Container Isolation file system filter driver unionfs.sys exposes memory that an attacker can read locally. The flaw is a classic bounds error (CWE 125) and allows a user with local privileges to retrieve unintended data, such as passwords, configuration values, or other sensitive material stored in memory. The resulting breach is a local information disclosure, requiring the attacker to already have access to the system.
Affected Systems
The Microsoft security advisory lists only Windows 11 26H1 as affected. No reference is made to earlier or subsequent releases, so the vulnerability is confined to this specific build. Systems running earlier builds or other operating systems are not mentioned as affected by this issue.
Risk and Exploitability
The CVSS score of 7.1 indicates a medium to high risk. The EPSS score of less than 1% suggests that the finding of exploitable installations in the wild is low. The vulnerability does not appear in the CISA KEV catalog. Because the flaw requires local privileged execution – an authorized attacker with user level or higher access – the main attack vector is local and relies on the owner or a user with elevated privileges to trigger the driver read. Organizations that frequently enable Container Isolation in Windows 11 should review whether this feature is necessary for their workload.
