{"id":"CVE-2026-113761","kind":"vulnerability","aliases":["CVE-2026-113761"],"related":[],"title":"Windows 11 26H1 container isolation driver (unionfs.sys) flaw lets a local user gain higher privileges","description":"Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","summary":"An untrusted pointer dereference in the Windows Container Isolation file system filter driver (unionfs.sys) lets an authorized local attacker raise their privileges. The flaw is local only, and the source gives a CVSS score of 7.0.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 11 version 26H1","fixed":["10.0.28000.3501"],"affected":">= 10.0.28000.0, < 10.0.28000.3501","ecosystem":"vendor"}],"ecosystems":[],"tags":["containers","infrastructure","local-privilege-escalation","windows","windows-11"],"not_affected_if":["no-local-access","not-windows-11-26h1"],"how_to_check":"On Windows 11 26H1 devices run 'winver' or PowerShell '[System.Environment]::OSVersion.Version'. Builds below 10.0.28000.3501 are affected. Other Windows versions are not listed in Microsoft's data for this CVE. Lower priority if the Containers and Windows Sandbox features are not enabled (unverified: the sources do not say the flaw needs them).","fix":"Install the November 10, 2026 cumulative update KB5132059 for Windows 11 26H1, which brings the build to 28000.3501 or later.","status":"open","published_at":"2026-11-10T19:18:55+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","triaged_at":"2026-11-10T19:52:17+00:00","updated_at":"2026-11-10T23:56:45+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-10T19:52:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows container driver flaw lets a local user gain higher privileges","impact":"high","summary":"An untrusted pointer dereference in the Windows Container Isolation file system filter driver (unionfs.sys) lets an authorized local attacker raise their privileges. The flaw is local only, and the source gives a CVSS score of 7.0.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","containers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains higher system privileges on the machine","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-113761 to confirm the fixed versions and detection steps.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Systems running Windows with the Windows Container Isolation feature present, where users already have a local account. The sources do not say which Windows builds or container configurations are affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4517,"output_tokens":418,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected Windows builds and the Microsoft advisory for CVE-2026-113761 to confirm the fixed versions and detection steps.","search":"'-11':34B '-113761':18A,21A '-2026':17A,20A '11':2A,23A '26h1':3A,25A '7.0':70B 'allow':82C 'attack':53B,85C 'author':51B,84C 'contain':4A,26B,42B,76C 'cve':16A,19A 'cvss':67B 'derefer':38B,73C 'driver':6A,47B,80C 'elev':87C 'escal':31B 'file':44B 'filter':46B,79C 'flaw':8A,58B 'fs':78C 'gain':13A 'give':65B 'higher':14A 'infrastructur':27B 'isol':5A,43B,77C 'let':9A,49B 'local':11A,29B,52B,60B,89C 'local-privilege-escal':28B 'pointer':37B,72C 'privileg':15A,30B,56B,88C 'rais':54B 'score':68B 'sourc':64B 'system':45B 'unionfs.sys':7A,48B,81C 'untrust':36B,71C 'user':12A 'version':24A 'window':1A,32B,33B,41B,75C 'windows':22A","nicknames":[],"mitigations":[],"who_affected":"Windows 11 version 26H1 devices (x64 and ARM64) below build 28000.3501, where an attacker already has a low-privilege local account. 26H1 ships only preinstalled on select new hardware, so most fleets running 24H2, 25H2 or 26H2 are not listed. The attack is local only and rated high complexity (a race condition is involved).","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["11version26h1","windows11version26h1"],"ptokens":["11","26h1","version","windows"],"labels":["containers","high","infrastructure","localprivilegeescalation","windows","windows11"],"campaign_type":null,"search_a":"'-113761':18A,21A '-2026':17A,20A '11':2A,23A '26h1':3A,25A 'contain':4A 'cve':16A,19A 'driver':6A 'flaw':8A 'gain':13A 'higher':14A 'isol':5A 'let':9A 'local':11A 'privileg':15A 'unionfs.sys':7A 'user':12A 'version':24A 'window':1A 'windows':22A","search_b":"'-11':34B '7.0':70B 'attack':53B 'author':51B 'contain':26B,42B 'cvss':67B 'derefer':38B 'driver':47B 'escal':31B 'file':44B 'filter':46B 'flaw':58B 'give':65B 'infrastructur':27B 'isol':43B 'let':49B 'local':29B,52B,60B 'local-privilege-escal':28B 'pointer':37B 'privileg':30B,56B 'rais':54B 'score':68B 'sourc':64B 'system':45B 'unionfs.sys':48B 'untrust':36B 'window':32B,33B,41B","search_c":"'allow':82C 'attack':85C 'author':84C 'contain':76C 'derefer':73C 'driver':80C 'elev':87C 'filter':79C 'fs':78C 'isol':77C 'local':89C 'pointer':72C 'privileg':88C 'unionfs.sys':81C 'untrust':71C 'window':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113761","severity":null,"published_at":"2026-11-10T19:18:55+00:00","modified_at":"2026-11-10T19:18:55+00:00","first_seen_at":"2026-11-10T19:24:40+00:00","fetched_at":"2026-11-10T19:24:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113761:3253","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-113761","severity":null,"published_at":"2026-11-10T23:56:45+00:00","modified_at":"2026-11-10T23:56:45+00:00","first_seen_at":"2026-11-10T23:56:45+00:00","fetched_at":"2026-11-10T23:56:45+00:00","note":"Microsoft CNA data (via NVD JSON) lists only Windows 11 26H1, 10.0.28000.0 up to <10.0.28000.3501; KB5132059 (Nov 10 2026) is build 28000.3501. MSRC page is JS-only and was not readable; KB page does not name the CVE, so nothing marked verified. No exploitation (CISA SSVC: exploitation none), no PoC found. Sibling unionfs.sys CVEs exist (CVE-2026-113771, 112753, 62772).","cites":["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-113761","https://support.microsoft.com/en-us/servicing/os/windows-11/2026/11/kb5132059-windows-11-26h1-security-update"]}],"documents":[{"id":120489,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-113761","title":"NVD record for CVE-2026-113761 (Microsoft CNA affected data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120490,"url":"https://support.microsoft.com/en-us/servicing/os/windows-11/2026/11/kb5132059-windows-11-26h1-security-update","title":"November 10, 2026 KB5132059 (OS Build 28000.3501), Windows 11 26H1","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}