This vulnerability is a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver, unionfs.sys. An attacker who can interact with the driver locally can overwrite memory and elevate privileges within both containers and the host operating system. Such privilege escalation can compromise confidentiality, integrity, and availability of containerized workloads and the underlying system. The flaw corresponds to CWE-122.

Microsoft Windows 11 releases 24H2, 25H2, 26H1, and 26H2 for ARM64 systems, as well as Windows Server 2022 and Windows Server 2025, including Server Core installations, are affected. The vulnerability is tied to the unionfs.sys component that enforces file-­system isolation for containers.

The CVSS score is 7.0, indicating a moderate to high severity, and the EPSS score is not available, so current exploitation likelihood is unclear. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an authorized local user who can send crafted requests to the driver, the attack vector is local. If exploited, an attacker could gain escalated privileges that allow modification of container state or host configuration.