What happened
CVE-2026-100223 is an elevation of privilege vulnerability involving reparse points created by sandboxed processes. A successful exploit could allow an attacker to escape the sandbox and elevate privileges on an affected system. Exploitation requires local access and a low-privileged account; the attacker must run a specially crafted application, but no action from another user is required. The vulnerability is rated high, with an NVD score of 7.8. A fix is available. The security update addresses the issue by preventing sandboxed processes from creating reparse points that target inaccessible files.
Who is affected
The verified affected scope includes the following Windows releases and version ranges:
Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688. Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487. Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846. Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846. Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711.
The listed Windows 10 releases cover 32-bit, ARM64 and x64 systems where specified in the vendor’s affected-version details; Windows 11 Version 23H2 includes ARM64 and x64 systems. Information on fixed version numbers is not yet available here; consult the vendor advisory for those details. NVD analysis remains in progress, so the scope may change.
Recommended actions
- Apply the available security update to affected Windows deployments, using the vendor advisory to confirm fixed-version details.
- Restrict low-privileged account access and permissions on affected hosts to limit opportunities for local privilege escalation.
- Restrict execution of unapproved applications through device-control measures, addressing the crafted-application step in the exploit path.
- Monitor endpoint activity for signs of sandbox escape or privilege elevation.
