A heap-based buffer overflow in the unionfs.sys filter driver that is part of Windows Container Isolation can be triggered by an attacker who already has local access. The overflow corrupts memory and allows the attacker to gain higher privileges on the host system. The vulnerability is a classic example of CWE-122 and can lead to complete compromise of the affected machine.

The flaw affects multiple Microsoft Windows platforms. Specific impacted releases include Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2022, Windows Server 2025, and the Server Core edition of Windows Server 2025. All devices running these operating systems are subject to the risk until the associated security update is applied.

The CVSS score of 7.8 indicates a high severity risk. With no EPSS score available, the probability of immediate exploitation is unclear, but the flaw would likely be used by an attacker who can execute code locally. The vulnerability is not listed in the CISA KEV catalog, meaning there is no confirmed public exploit yet. Nonetheless, the combination of local access and privilege escalation warrants prompt remediation.