Executive brief
The Windows Bind Filter Driver, a core component of the Windows operating system responsible for network adapter binding and filter management, contains a use-after-free vulnerability that allows an authorized local user to elevate their privileges. An attacker with existing system access could exploit this flaw to gain elevated permissions, potentially leading to complete system compromise and the ability to install malware or access sensitive data.
Technical details
This vulnerability is a use-after-free memory corruption flaw in the Windows Bind Filter Driver (bindfilterdriver.sys). The vulnerability allows an authenticated local attacker to trigger a condition where freed memory is accessed and executed, enabling privilege escalation from user mode to kernel mode. The attack requires prior local access to the system and the ability to execute code with user-level privileges. Successful exploitation results in elevation of privileges to SYSTEM level. Microsoft has released security patches to address this issue.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed