CVE-2026-113771

MediumCVSS 5.5/10Last modified Nov 10, 2026

Description

Off-by-one error in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-193

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.3501

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1137724.7Time-of-check time-of-use (toctou) race condition in Windows Redirected Drive Buffering allows an authorized attacker to disclose informatioCVE-2026-1137735.3Improper access control in Windows DHCP Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1137757.8A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk FCVE-2026-1137767.8virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_templatCVE-2026-1137798.8The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalCVE-2026-113788.8IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow iCVE-2026-1137809.3ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry inCVE-2026-1137827.1ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.0 until 5.2.8, 5.3.6, 5.4.5, 5.5.5, and 6.0.3, the OpenThrCVE-2026-1137837.4ESP-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.2.3 until 5.3.7, 5.4.5, 5.5.6, and 6.0.3, the lwIP DNS resolCVE-2026-1137862.3pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with theCVE-2026-1137876.1odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in vCVE-2026-1137889.4Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core
CVE-2026-113771: Medium severity, CVSS 5.5 | Vulnix