MicrosoftCVE-2026-61927

Microsoft Windows Bind Filter Driver: use after free

High7.0CVE-2026-61927 · Published Aug 11, 2026 · updated Aug 13, 2026

Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Windows 11 Version 24H2 Product	>= 10.0.26100.0, < 10.0.26100.9168	10.0.26100.9168
Windows 11 Version 25H2 Product	>= 10.0.26200.0, < 10.0.26200.9168	10.0.26200.9168
Windows 11 version 26H1 Product	>= 10.0.28000.0, < 10.0.28000.2704	10.0.28000.2704
Windows Server 2025 Product	>= 10.0.26100.0, < 10.0.26100.33296	10.0.26100.33296
Windows Server 2025 (Server Core installation) Product	>= 10.0.26100.0, < 10.0.26100.33296	10.0.26100.33296

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-362, CWE-416

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Aug 11	Copilot Chat Security Feature Bypass Vulnerability High7.1Aug 11 CVE-2026-656751.132.1	High7.1	1.132.1
Aug 11	Copilot Custom Agent Hook Remote Code Execution Vulnerability High7.8Aug 11 CVE-2026-703351.132.1	High7.8	1.132.1
Aug 11	Information disclosure vulnerability MediumAug 11 CVE-2026-472851.132.1	Medium	1.132.1
Aug 11	Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS High8.8Aug 11 CVE-2026-703361.132.1	High8.8	1.132.1
Aug 11	Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload High8.8Aug 11 CVE-2026-693201.132.1	High8.8	1.132.1
Aug 11	TerminalInstance._createProcess - Workspace Trust bypass via terminal waitOnExit High7.8Aug 11 CVE-2026-692781.132.1	High7.8	1.132.1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.