{"id":"CVE-2026-113771","kind":"vulnerability","aliases":["CVE-2026-113771"],"related":[],"title":"Windows container filesystem driver off-by-one lets local users gain privileges","description":"Off-by-one error in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.","summary":"An off-by-one error in the Windows Container Isolation filesystem filter driver (unionfs.sys) lets an authorized local user elevate their privileges. The attacker needs an existing local account on the affected Windows machine.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","infrastructure","windows","windows-server"],"not_affected_if":["no-container-isolation","single-user-machines"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:57+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","triaged_at":"2026-11-10T20:02:00+00:00","updated_at":"2026-11-10T20:02:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:02:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows container filesystem driver off-by-one lets local users gain privileges","impact":"high","summary":"An off-by-one error in the Windows Container Isolation filesystem filter driver (unionfs.sys) lets an authorized local user elevate their privileges. The attacker needs an existing local account on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","containers","windows-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated system privileges on the machine","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-113771 for affected Windows builds and the patch KB.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-container-isolation","single-user-machines"],"who_is_affected":"Windows machines running the Windows Container Isolation feature, where unionfs.sys is present, are the systems to look at. Only users who already have a local account on those machines can use this flaw, so machines without container isolation or without local multi-user access carry less exposure. The sources do not give the affected Windows builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4514,"output_tokens":466,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113771':16A,19A '-2026':15A,18A 'account':55B 'affect':58B 'allow':74C 'attack':50B,77C 'author':43B,76C 'contain':2A,20B,35B,68C 'cve':14A,17A 'driver':4A,39B,72C 'elev':46B,79C 'error':31B,65C 'exist':53B 'filesystem':3A,37B 'filter':38B,71C 'fs':70C 'gain':12A 'infrastructur':21B 'isol':36B,69C 'let':9A,41B 'local':10A,44B,54B,81C 'machin':60B 'need':51B 'off-by-on':5A,27B,61C 'one':8A,30B,64C 'privileg':13A,48B,80C 'server':25B 'unionfs.sys':40B,73C 'user':11A,45B 'window':1A,22B,24B,34B,59B,67C 'windows-serv':23B","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the Windows Container Isolation feature, where unionfs.sys is present, are the systems to look at. Only users who already have a local account on those machines can use this flaw, so machines without container isolation or without local multi-user access carry less exposure. The sources do not give the affected Windows builds.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containers","infrastructure","medium","windows","windowsserver"],"campaign_type":null,"search_a":"'-113771':16A,19A '-2026':15A,18A 'contain':2A 'cve':14A,17A 'driver':4A 'filesystem':3A 'gain':12A 'let':9A 'local':10A 'off-by-on':5A 'one':8A 'privileg':13A 'user':11A 'window':1A","search_b":"'account':55B 'affect':58B 'attack':50B 'author':43B 'contain':20B,35B 'driver':39B 'elev':46B 'error':31B 'exist':53B 'filesystem':37B 'filter':38B 'infrastructur':21B 'isol':36B 'let':41B 'local':44B,54B 'machin':60B 'need':51B 'off-by-on':27B 'one':30B 'privileg':48B 'server':25B 'unionfs.sys':40B 'user':45B 'window':22B,24B,34B,59B 'windows-serv':23B","search_c":"'allow':74C 'attack':77C 'author':76C 'contain':68C 'driver':72C 'elev':79C 'error':65C 'filter':71C 'fs':70C 'isol':69C 'local':81C 'off-by-on':61C 'one':64C 'privileg':80C 'unionfs.sys':73C 'window':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113771","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113771","severity":null,"published_at":"2026-11-10T19:18:57+00:00","modified_at":"2026-11-10T19:18:58+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","fetched_at":"2026-11-10T19:24:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}