Medium · 5.5 CVE-2026-97790 EUVD-2026-100310GHSA-hg3m-hc8g-63v7

Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability

Published Oct 13, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 11 Version 24H2 Product: Windows 11 Version 25H2 Product: Windows 11 version 26H1 Product: Windows 11 Version 26H2 Product: Windows Server 2022 Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows 11 Version 24H2	10.0.26100.0 – < 10.0.26100.9711	10.0.26100.9711
Microsoft	Windows 11 Version 25H2	10.0.26200.0 – < 10.0.26200.9711	10.0.26200.9711
Microsoft	Windows 11 version 26H1	10.0.28000.0 – < 10.0.28000.3231	10.0.28000.3231
Microsoft	Windows 11 Version 26H2	10.0.26300.0 – < 10.0.26300.9711	10.0.26300.9711
Microsoft	Windows Server 2022	10.0.20348.0 – < 10.0.20348.5761	10.0.20348.5761
Microsoft	Windows Server 2025	10.0.26100.0 – < 10.0.26100.33650	10.0.26100.33650
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – < 10.0.26100.33650	10.0.26100.33650

Advisories 2

WID-SEC-2026-3892 Microsoft Windows und Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
MSRC-CVE-2026-97790 Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability Microsoft Security Response Center · Oct 13, 2026

References

Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability vendor-advisory patch