{"id":"CVE-2026-100223","kind":"vulnerability","aliases":["CVE-2026-100223"],"related":[],"title":"Windows: sandboxed processes can create reparse points and escape the sandbox","description":"An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system.\nTo exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.\nThe security update addresses the vulnerability by preventing sandboxed processes from creating reparse points targeting inaccessible files.","summary":"A sandboxed process can create reparse points that target inaccessible files, which lets it escape the sandbox. An attacker who has logged on can run a crafted application to gain higher privileges on the affected system.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","windows"],"not_affected_if":["no-local-logon"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:39+00:00","first_seen_at":"2026-11-10T19:24:12+00:00","triaged_at":"2026-11-10T19:42:45+00:00","updated_at":"2026-11-10T19:42:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: sandboxed processes can create reparse points and escape the sandbox","impact":"high","summary":"A sandboxed process can create reparse points that target inaccessible files, which lets it escape the sandbox. An attacker who has logged on can run a crafted application to gain higher privileges on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","self-hosted"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"local attacker gains elevated privileges on the system","analyst_note":"Find the affected Windows builds and the Microsoft security update that fixes CVE-2026-100223 on the MSRC page; sources here give no version or fix detail.","how_to_check":"unknown","plain_action":"","product_name":"Windows","needs_analyst":true,"not_affected_if":["no-local-logon"],"who_is_affected":"Systems where untrusted or low-privilege users can run applications that launch sandboxed processes. The sources do not name the affected Windows builds, so check the vendor's security update list for CVE-2026-100223. Machines with no local logon by untrusted users are less exposed.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4614,"output_tokens":472,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the affected Windows builds and the Microsoft security update that fixes CVE-2026-100223 on the MSRC page; sources here give no version or fix detail.","search":"'-100223':14A,17A '-2026':13A,16A 'address':127C 'affect':57B,93C,122C 'allow':73C 'applic':50B,116C 'attack':41B,77C,100C 'control':119C 'could':83C 'craft':49B,115C 'creat':5A,27B,69C,135C 'cve':12A,15A 'elev':60C,89C 'escap':9A,37B,75C,87C 'exist':64C 'exploit':80C,96C 'file':33B,140C 'first':102C 'gain':52B 'higher':53B 'host':21B 'inaccess':32B,139C 'infrastructur':18B 'let':35B 'log':44B,105C 'point':7A,29B,67C,137C 'prevent':131C 'privileg':54B,62C,90C 'process':3A,25B,72C,133C 'repars':6A,28B,66C,136C 'run':47B,112C 'sandbox':2A,11A,24B,39B,71C,74C,86C,132C 'secur':125C 'self':20B 'self-host':19B 'special':114C 'success':79C 'system':58B,94C,109C,123C 'take':118C 'target':31B,138C 'updat':126C 'use':84C 'vulner':63C,82C,98C,129C 'window':1A,22B 'would':101C","nicknames":[],"mitigations":[],"who_affected":"Systems where untrusted or low-privilege users can run applications that launch sandboxed processes. The sources do not name the affected Windows builds, so check the vendor's security update list for CVE-2026-100223. Machines with no local logon by untrusted users are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","selfhosted","windows"],"campaign_type":null,"search_a":"'-100223':14A,17A '-2026':13A,16A 'creat':5A 'cve':12A,15A 'escap':9A 'point':7A 'process':3A 'repars':6A 'sandbox':2A,11A 'window':1A","search_b":"'affect':57B 'applic':50B 'attack':41B 'craft':49B 'creat':27B 'escap':37B 'file':33B 'gain':52B 'higher':53B 'host':21B 'inaccess':32B 'infrastructur':18B 'let':35B 'log':44B 'point':29B 'privileg':54B 'process':25B 'repars':28B 'run':47B 'sandbox':24B,39B 'self':20B 'self-host':19B 'system':58B 'target':31B 'window':22B","search_c":"'address':127C 'affect':93C,122C 'allow':73C 'applic':116C 'attack':77C,100C 'control':119C 'could':83C 'craft':115C 'creat':69C,135C 'elev':60C,89C 'escap':75C,87C 'exist':64C 'exploit':80C,96C 'file':140C 'first':102C 'inaccess':139C 'log':105C 'point':67C,137C 'prevent':131C 'privileg':62C,90C 'process':72C,133C 'repars':66C,136C 'run':112C 'sandbox':71C,74C,86C,132C 'secur':125C 'special':114C 'success':79C 'system':94C,109C,123C 'take':118C 'target':138C 'updat':126C 'use':84C 'vulner':63C,82C,98C,129C 'would':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100223","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100223","severity":null,"published_at":"2026-11-10T19:17:39+00:00","modified_at":"2026-11-10T19:17:39+00:00","first_seen_at":"2026-11-10T19:24:12+00:00","fetched_at":"2026-11-10T19:24:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}