---
id: "CVE-2026-112753"
page: "https://infrastack.ai/live/CVE-2026-112753"
kind: "vulnerability"
aliases: ["CVE-2026-112753"]
title: "Windows Container Isolation driver type confusion lets local users gain privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 11 version 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "vendor"}]
ecosystems: []
tags: ["containers", "infrastructure", "local-privilege-escalation", "windows"]
not_affected_if: ["no-windows-containers"]
published_at: "2026-11-10T19:18:35+00:00"
first_seen_at: "2026-11-10T19:24:31+00:00"
updated_at: "2026-11-11T00:12:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112753", "first_seen_at": "2026-11-10T19:24:31+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-112753", "first_seen_at": "2026-11-11T00:12:29+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-112753", "https://www.rapid7.com/db/vulnerabilities/cve-2026-112753/"]}]
exploit_sources: []
---

# Windows Container Isolation driver type confusion lets local users gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-112753 (this .md is for agents)

A type confusion flaw in the Windows Container Isolation FS Filter Driver (unionfs.sys) lets an authorized attacker raise their privileges on the local machine. The sources rate it high (CVSS 7.0) and do not report active exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 11 version 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501

## How to check

Run winver or [System.Environment]::OSVersion in PowerShell on Windows 11 26H1 hosts: a build below 10.0.28000.3501 is in the affected range. Also check whether Windows containers are used (Get-WindowsOptionalFeature -Online -FeatureName Containers) and whether unionfs.sys is present (Get-Item C:\Windows\System32\drivers\unionfs.sys). Whether it loads by default is not confirmed.

## Fix

Update Windows 11 version 26H1 to OS build 10.0.28000.3501 or later (per Microsoft CNA data in NVD; KB number not confirmed).

## Timeline

- 2026-11-10T19:24:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112753
- 2026-11-11T00:12:29+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-112753 — MSRC page is JS-only and unreadable here; affected range from Microsoft CNA data on NVD (Win 11 26H1 < 10.0.28000.3501). KB number and default-load of unionfs.sys unconfirmed. No exploitation or PoC found. Nothing verified.

## Documents

- [describes] NVD CVE-2026-112753 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-112753
- [mentions] Rapid7 CVE-2026-112753 https://www.rapid7.com/db/vulnerabilities/cve-2026-112753/

## From the sources

Access of resource using incompatible type ('type confusion') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_