This vulnerability (CVE-2026-50428) involves an out-of-bounds read in the Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11 version 26H1 (build 10.0.28000.0). The flaw permits an authorized attacker with local access to read memory outside the intended bounds, potentially disclosing sensitive information. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. Microsoft has released an official fix for this vulnerability.

An authorized local attacker can exploit this out-of-bounds read vulnerability to disclose sensitive information from memory, which could lead to information leakage. The vulnerability does not impact integrity but has a high impact on confidentiality and availability according to the CVSS vector. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the provided security update from Microsoft as soon as possible to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.