CVE-2026-97790
MediumCVSS 5.5Summary
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
Risk Assessment
An authorized attacker can locally modify or tamper with data, potentially leading to system integrity breaches. Organizations using Windows container isolation are exposed to local tampering attacks.
Recommendation
Update the unionfs.sys driver to the latest patched version. Restrict local system access to trusted users only.
Other vulnerabilities in Windows Container Isolation FS Filter Driver
See all- CVE-2026-97810High
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- CVE-2026-97794High
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- CVE-2026-97792High
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- CVE-2026-97787High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- CVE-2026-70270Medium
Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.
- CVE-2026-102202High
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- CVE-2026-72971Medium
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
- CVE-2026-62775Medium
Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.
- CVE-2026-62772High
Heap-based buffer overflow in the Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
- CVE-2026-50428High
Out-of-bounds read in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS