CVE-2026-62772: Windows 11 26h1 Privilege Escalation Flaw

CVE-2026-62772 Overview

CVE-2026-62772 is a heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys). An authorized local attacker can exploit the flaw to elevate privileges on affected systems. Microsoft published the advisory on 2026-08-11, and the vulnerability is tracked under CWE-122 for heap-based buffer overflow. The issue affects Microsoft Windows 11 26H1 on both x64 and ARM64 architectures. Successful exploitation delivers high impact to confidentiality, integrity, and availability of the target host.

Critical Impact
A local attacker with low privileges can corrupt kernel heap memory through unionfs.sys and gain SYSTEM-level control of the Windows host.

Affected Products

Microsoft Windows 11 26H1 (x64)
Microsoft Windows 11 26H1 (ARM64)
Windows Container Isolation FS Filter Driver (unionfs.sys)

Discovery Timeline

2026-08-11 - CVE-2026-62772 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62772

Vulnerability Analysis

The vulnerability resides in unionfs.sys, the file system filter driver that supports Windows Container Isolation. The driver mediates file system operations between the host and containerized workloads. A heap-based buffer overflow in this driver allows an authenticated local user to write past the bounds of a kernel heap allocation. Because the driver executes in kernel mode, memory corruption can be steered toward arbitrary code execution or manipulation of privileged kernel structures. The result is local privilege escalation from a standard user context to SYSTEM. Microsoft's advisory confirms the impact and lists the affected Windows 11 26H1 builds (Microsoft CVE-2026-62772 Advisory).

Root Cause

The root cause is improper validation of a length or size value used during a heap allocation or copy in unionfs.sys. When the driver processes attacker-influenced input tied to container isolation file operations, it copies more data than the destination buffer can hold. Adjacent heap metadata or pool objects become corruptible, which is the canonical CWE-122 pattern.

Attack Vector

Exploitation requires local access and valid low-privileged credentials. No user interaction is needed. The attacker interacts with the driver through documented or reachable IOCTLs, file system requests, or container-related APIs that route to unionfs.sys. A crafted request triggers the overflow, and shaped kernel pool memory converts the corruption into privilege escalation. No public proof-of-concept or in-the-wild exploitation has been reported.

// No verified exploit code is publicly available for CVE-2026-62772.
// Refer to the Microsoft Security Response Center advisory for technical details:
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62772

Detection Methods for CVE-2026-62772

Indicators of Compromise

Unexpected loading or interaction with unionfs.sys from non-container workloads or standard user sessions.
New SYSTEM-level processes spawned from a parent process running under a low-privileged user token.
Kernel pool corruption events, bugchecks, or crash dumps referencing unionfs.sys on Windows 11 26H1 hosts.

Detection Strategies

Hunt for anomalous handles to Container Isolation devices opened by non-container, non-administrative processes.
Correlate local logon events with subsequent token elevation or SYSTEM process creation on the same host.
Monitor Windows Error Reporting and Event Log entries citing unionfs.sys faults, which may indicate exploitation attempts or instability.

Monitoring Recommendations

Enable kernel-mode audit and driver load telemetry on Windows 11 26H1 endpoints.
Forward endpoint telemetry to a centralized data lake to build baselines for unionfs.sys activity and detect deviations.
Track privilege escalation techniques mapped to MITRE ATT&CK T1068 (Exploitation for Privilege Escalation) across the fleet.

How to Mitigate CVE-2026-62772

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-62772 Advisory to all Windows 11 26H1 systems.
Inventory hosts running Windows 11 26H1 on x64 and ARM64 and prioritize patch deployment for multi-user or shared systems.
Restrict interactive and remote logon rights for untrusted or low-trust accounts until patching completes.

Patch Information

Microsoft has published the security update through the Microsoft Security Response Center. Refer to the Microsoft CVE-2026-62772 Advisory for the specific KB numbers and cumulative update packages that address unionfs.sys on Windows 11 26H1 x64 and ARM64.

Workarounds

No official workaround is listed by Microsoft; installing the security update is the supported remediation.
Where patching must be deferred, limit which accounts can invoke Windows containers or interact with Container Isolation features.
Apply application control policies to block untrusted binaries from launching on affected hosts.

bash

# Verify installed updates on Windows 11 26H1 hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Confirm the version of unionfs.sys currently loaded
Get-Item C:\Windows\System32\drivers\unionfs.sys | Select-Object VersionInfo