Description

Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-11T17:19:15.220Z",
  "pubdate": "2026-08-11T17:19:15.220Z",
  "executiveSummary": "An improper link resolution before file access vulnerability, commonly referred to as link following, exists in the Windows Container Isolation FS Filter Driver (unionfs.sys). This security flaw allows an authorized local attacker to perform unauthorized file tampering on the affected system.\nThe vulnerability resides within the file system filtering mechanism responsible for container isolation boundaries. By successfully exploiting this flaw, a local adversary with appropriate authorization can manipulate file system objects across isolation boundaries, potentially leading to integrity violations, unauthorized data modification, or privilege escalation primitives depending on the surrounding system configuration.\nThe attack requires local access to the target host and execution capability under an authorized security context. The risk implications include the potential bypass of container isolation guarantees, allowing malicious actors to influence files outside their intended scope or sandbox boundaries.\nNo specific version numbers or external URLs were provided in the input, but the affected component is strictly identified as the Windows Container Isolation FS Filter Driver utilizing unionfs.sys. Remediation typically involves applying vendor-supplied updates or patches designed to enforce proper symbolic link and hard link resolution checks during file access operations.",
  "technicalDetails": "The vulnerability is rooted in a race condition or logic flaw involving improper link resolution before file access, frequently classified as a Time-of-Check to Time-of-Use (TOCTOU) or inadequate validation of reparse points, symbolic links, or hard links within kernel-mode file system filter drivers. Specifically, the vulnerable component is the Windows Container Isolation FS Filter Driver, implemented via the unionfs.sys driver.\nIn containerized environments, isolation drivers intercept I/O requests to ensure that containerized processes only interact with their designated virtualized file system layers. The vulnerability occurs when unionfs.sys resolves paths or processes file access requests without securely verifying whether the target of the operation traverses unauthorized symbolic links or directory junctions. Because the driver fails to properly validate the final target of a link prior to performing the file operation, an authorized local user can substitute expected files or directories with crafted links pointing to sensitive system locations.\nThe attack flow proceeds as follows: First, the local attacker establishes a vantage point within an authorized execution context on the host or container environment. Second, the attacker prepares a manipulated file system structure utilizing symbolic links or reparse points that target files intended for protection or isolation. Third, the attacker triggers an operation processed by unionfs.sys that interacts with the linked path. Fourth, due to the absence of secure link resolution checks, the driver resolves the link and performs the requested file access or modification against the unintended target resource.\nThe technical prerequisites for exploitation include local access and authorization to interact with the container isolation environment. The network exposure is strictly local, as the attack vector requires local execution privileges. The post-exploitation impact includes unauthorized file tampering, potential corruption of critical system or container resources, and the degradation of container isolation boundaries. The behavior of the payload is centered on manipulating the file system integrity by abusing kernel-level path resolution logic in unionfs.sys."
}