CVE-2026-62775

CVE-2026-62775 is an incorrect authorization vulnerability in unionfs.sys, the kernel-mode filesystem filter driver that implements Windows container isolation. The bug allows a local authorized attacker inside a container to access filesystem information they shouldn't have—information that, in containerized environments, frequently serves as a pivot point toward container escape or host compromise. The CVSS 5.5 score assigned to this vulnerability is analytically dangerous. In cloud environments running Windows containers—Azure Kubernetes Service nodes, Windows Server containers, CI/CD pipelines with untrusted workloads—the "authorized attacker" constraint in the CVE description obscures the real threat model. An attacker who has achieved initial access through any separate mechanism (phishing, credential compromise, application vulnerability) becomes that "authorized" user, and the authorization flaw becomes the escalation vector. The blast radius isn't measured by the CVSS vector; it's measured by the density of high-value multi-tenant infrastructure dependent on unionfs.sys getting this right. What makes this class of vulnerability persistent isn't developer incompetence—it's structural. The filter callback ordering, implicit security context inheritance, and interaction between overlay filesystem semantics and Windows ACL evaluation create a cognitive load that exceeds what manual threat modeling can reliably catch. The genealogical record is telling: authorization bugs in container isolation drivers follow predictable patterns across vendors and OS generations, clustering around the same failure modes even in mature codebases with professional security teams. The practical implication: treat this not as an isolated patch but as evidence of a recurring architectural problem. Your defense posture should assume that similar authorization gaps exist across the filter driver stack in your container hosts. Prioritize monitoring for filesystem operations that cross container-host boundaries unexpectedly, audit your container isolation policies against the principle of least privilege, and scrutinize any container escape detection logic for blind spots that information disclosure could exploit. The fix was identifiable and addressable—but the question the CVE should raise is whether your monitoring and response infrastructure can catch the next one in this lineage before it becomes a pivot point for host compromise.

Reviewed through automated stages and approved by a human before publication.