---
id: "CVE-2026-100223"
page: "https://infrastack.ai/live/CVE-2026-100223"
kind: "vulnerability"
aliases: ["CVE-2026-100223"]
title: "Windows NTFS: sandboxed processes can create reparse points and escape the sandbox to SYSTEM"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "local", "ntfs", "privilege-escalation", "sandbox-escape", "self-hosted", "windows"]
not_affected_if: ["no-local-logon", "patched-2026-nov"]
published_at: "2026-11-10T19:17:39+00:00"
first_seen_at: "2026-11-10T19:24:12+00:00"
updated_at: "2026-11-11T01:13:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100223", "first_seen_at": "2026-11-10T19:24:12+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-100223", "first_seen_at": "2026-11-11T01:13:07+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-100223"]}]
exploit_sources: []
---

# Windows NTFS: sandboxed processes can create reparse points and escape the sandbox to SYSTEM

Link for people: https://infrastack.ai/live/CVE-2026-100223 (this .md is for agents)

Microsoft rates this Windows NTFS use-after-free (CWE-416) Important, CVSS 7.8. A local attacker who is already logged on runs a crafted application. A sandboxed process can create reparse points that target inaccessible files, which gives a sandbox escape and SYSTEM privileges. Microsoft's update stops sandboxed processes from creating reparse points that target inaccessible files. Microsoft lists it as not exploited and not publicly disclosed, with exploitation rated Less Likely (November 2026 release).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: the MSRC page I could read gives no build or KB list. Look up CVE-2026-100223 in the MSRC Update Guide for your Windows version, then compare it with your installed November 2026 cumulative update (winver or Get-HotFix).

## Fix

Install the November 2026 (2026-Nov) Windows security update for your Windows version. KB and build numbers are unknown; see the MSRC Update Guide.

## Timeline

- 2026-11-10T19:24:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100223
- 2026-11-11T01:13:07+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-100223 — Read MSRC SUG API JSON: NTFS EoP, Important, CVSS 7.8, not exploited, not disclosed, Less Likely. No affected builds or KBs in it, so nothing verified (no --verify). Search/X not tried.

## Documents

- [advisory] MSRC: CVE-2026-100223 Windows NTFS Elevation of Privilege Vulnerability https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-100223

## From the sources

An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system.
To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system.
The security update addresses the vulnerability by preventing sandboxed processes from creating reparse points targeting inaccessible files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_