CVE-2026-50428: Windows Container Isolation Information Leak

CVE-2026-50428 Overview

CVE-2026-50428 is an out-of-bounds read vulnerability [CWE-125] in the Windows Container Isolation FS Filter Driver (unionfs.sys). An authorized local attacker can exploit the flaw to disclose sensitive kernel memory or trigger a denial-of-service condition on the affected host. The vulnerability requires local access and low privileges, with no user interaction. Because unionfs.sys operates in kernel mode, disclosed data may include memory contents from privileged processes and other tenants sharing the container isolation stack. Microsoft has published a security advisory tracking this issue.

Critical Impact
Local authorized attackers can read out-of-bounds kernel memory through the Windows Container Isolation FS Filter Driver, exposing sensitive information and potentially crashing the host.

Affected Products

Microsoft Windows (Container Isolation FS Filter Driver, unionfs.sys)
Windows hosts running container isolation workloads
Systems where the unionfs.sys filter driver is loaded

Discovery Timeline

2026-07-14 - CVE-2026-50428 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-50428

Vulnerability Analysis

The flaw resides in unionfs.sys, the Windows Container Isolation FS Filter Driver responsible for presenting a merged filesystem view to containerized workloads. The driver reads beyond the bounds of an allocated buffer while processing filesystem requests, returning uninitialized or adjacent kernel memory to the caller. An attacker with local access and low privileges can craft filesystem operations that exercise the vulnerable code path. Successful exploitation yields confidentiality loss through information disclosure and can degrade availability if the driver faults. Integrity of the affected data is not directly impacted.

Root Cause

The underlying defect is classified as an out-of-bounds read [CWE-125]. The driver fails to correctly validate a length or offset value before performing a read from a kernel buffer. When the calculated read extends past the buffer boundary, the driver returns adjacent kernel pool contents to the requesting process. Microsoft has not published detailed technical internals in the public advisory.

Attack Vector

Exploitation requires local, authenticated access to a Windows system that loads unionfs.sys. The attacker issues crafted filesystem I/O requests through the container isolation interface that reach the vulnerable parsing routine. No user interaction is required. Because the attack is local and requires existing privileges, it is most relevant on multi-tenant container hosts and shared workstation environments where an unprivileged process could harvest kernel data.

No public proof-of-concept exploit is available. Refer to the Microsoft Security Advisory CVE-2026-50428 for vendor technical details.

Detection Methods for CVE-2026-50428

Indicators of Compromise

Unexpected loading or repeated crashes of the unionfs.sys filter driver in kernel logs
Bugcheck events (BSOD) referencing unionfs.sys or Container Isolation components
Anomalous filesystem I/O patterns from low-privilege processes targeting container-isolated volumes

Detection Strategies

Monitor Windows Error Reporting and WER telemetry for faults involving unionfs.sys
Correlate process creation events with subsequent container filesystem access from non-container workloads
Track loading of the Container Isolation FS Filter Driver on hosts that do not run container workloads

Monitoring Recommendations

Enable kernel-mode crash dump collection on container hosts to capture exploitation attempts
Aggregate driver load and unload events into a centralized log store for baseline comparison
Alert on unprivileged users issuing filesystem control codes (FSCTL) associated with container isolation

How to Mitigate CVE-2026-50428

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Advisory CVE-2026-50428 as soon as it is available for your Windows build
Inventory hosts where unionfs.sys is loaded and prioritize patching multi-tenant and shared systems
Restrict local logon rights on affected systems to trusted administrative accounts

Patch Information

Microsoft has published guidance for CVE-2026-50428 through the Microsoft Security Response Center. Consult the Microsoft Security Advisory CVE-2026-50428 for the specific KB article, affected Windows builds, and update packages applicable to your environment. Deploy the update through Windows Update, WSUS, or your enterprise patch management system.

Workarounds

Disable Windows container features on hosts that do not require them, which prevents unionfs.sys from loading
Enforce least-privilege access policies and remove interactive logon rights from service accounts on container hosts
Isolate multi-tenant container hosts from untrusted workloads until the patch is applied

bash

# Check whether the Container Isolation FS Filter Driver is loaded
fltmc filters | findstr /I unionfs

# Query installed updates to confirm patch presence (replace KB with the KB from the MSRC advisory)
wmic qfe list brief | findstr /I KBxxxxxxx