A race condition in the Windows Container Isolation FS Filter Driver (unionfs.sys) permits a locally authorized attacker to gain higher privileges, potentially elevating a non-administrator user to administrator status. The weakness arises from concurrent execution on a shared resource without proper synchronization, classified as a race condition (CWE-362).

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2, Microsoft Windows Server 2022, and Microsoft Windows Server 2025 (including Server Core), across ARM64 and x64 architectures.

The CVSS score of 7 indicates a moderate‑to‑high severity vulnerability. The EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, suggesting no widespread exploitation as of the last update. The attack vector is local; an attacker with existing user privileges can exploit the race condition to elevate their own privileges. Although no remote exploitation is described, the ability to gain system‑level access can enable a range of subsequent attacks such as persistence, data exfiltration, or further compromise of the host.