Description

Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:29.930Z",
  "pubdate": "2026-08-11T17:18:29.930Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists within the Windows Container Isolation FS Filter Driver, specifically located in the unionfs.sys driver. This vulnerability permits an authorized local attacker to execute arbitrary code within kernel space, leading directly to a local privilege escalation. The flaw affects systems utilizing the Windows Container Isolation architecture. The risk implication is severe, as successful exploitation compromises the entire operating system kernel, enabling attackers to bypass security boundaries, install malicious drivers, access sensitive data, or manipulate system processes with highest-level privileges. Exploitation of this vulnerability requires the attacker to possess prior local access and authorization to interact with the affected driver component. The attack vector is strictly local, with no remote network exposure indicated. Mitigation relies on applying vendor-supplied security updates and driver patches as made available by Microsoft to resolve the underlying memory management defect within unionfs.sys.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow residing in the Windows Container Isolation FS Filter Driver, implemented by the kernel-mode driver file unionfs.sys. Root cause analysis of memory corruption vulnerabilities in kernel-mode file system filter drivers typically points to insufficient bounds checking, integer overflows during buffer size calculations, or improper handling of input data supplied via IOCTL (Input/Output Control) requests from user-mode to kernel-mode. In this scenario, when unionfs.sys processes specially crafted input structures within kernel memory, a memory allocation on the paged or non-paged kernel heap receives more data than the allocated buffer can accommodate, resulting in a heap-based buffer overflow.\nTo execute the attack, an authorized local attacker must first establish interaction with the vulnerable unionfs.sys driver interface. This typically involves opening a handle to the device exposed by the driver using standard Windows APIs such as CreateFile. Once a valid handle is obtained, the attacker crafts a malicious payload containing specially formatted data designed to exceed the bounds of the destination buffer on the kernel heap. The payload is subsequently transmitted to the driver via device control requests using functions like DeviceIoControl.\nUpon receiving the malicious input, unionfs.sys fails to properly validate the length of the incoming buffer against the destination pool allocation size. Consequently, the oversized payload overflows the heap buffer, overwriting adjacent kernel heap structures, function pointers, or object headers. By carefully controlling the heap layout and the contents of the overflow, the attacker can manipulate critical kernel structures. Successful exploitation leads to arbitrary kernel code execution. Because kernel-mode code runs with the highest privilege level (Ring 0), this grants the attacker complete control over the operating system, bypassing all user-mode security controls and enabling full local privilege escalation."
}