High · 7.0 CVE-2026-25184 EUVD-2026-22367

Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability

Published Apr 14, 2026 · Updated Oct 15, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 11 version 23H2 Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows 11 version 26H1 Product: Windows Server 2022, 23H2 Edition (Server Core installation) Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 11 version 23H2	10.0.22631.0 – < 10.0.22631.6936	10.0.22631.6936
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.8246	10.0.26100.8246
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.8246	10.0.26200.8246
Microsoft	Windows 11 version 26H1	10.0.28000.0 – < 10.0.28000.1836	10.0.28000.1836
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	10.0.25398.0 – < 10.0.25398.2274	10.0.25398.2274
Microsoft	Windows Server 2025	10.0.26100.0 – < 10.0.26100.32690	10.0.26100.32690
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – < 10.0.26100.32690	10.0.26100.32690

Advisories 3

WID-SEC-2026-1104 Microsoft Windows: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 27, 2026
NCSC-2026-0119 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Apr 15, 2026
MSRC-CVE-2026-25184 Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability Microsoft Security Response Center · Apr 14, 2026

References

Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability vendor-advisory patch