An untrusted pointer dereference in the Windows Container Isolation FS Filter Driver permits an authorized local attacker to elevate privileges. The CWE-822 weakness can give the attacker elevated system permissions within the container host, potentially leading to unauthorized access to system resources and infrastructure.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2016 (including Server Core), 2019 (including Server Core), 2022, and 2025 (including Server Core) are affected. The vulnerability also applies to arm64-based Windows 11 and Windows Server builds.

The CVSS score is 5.5 and the EPSS score is not available, indicating a moderate severity with unknown exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known malicious exploitation at this time. The attack vector is local, requiring the attacker to have authorized access to the host system. Successful exploitation could provide full system privileges, elevating the threat to a significant risk for affected environments.