Windows Container Manager Service: Information disclosure through TOCTOU race condition

Summary

The Windows Container Manager Service in several supported Windows 10 and Windows 11 builds contains a time-of-check time-of-use race condition (CWE-367). An authorized local attacker can exploit the timing gap to read information they should not see. Exploitation requires high complexity, low privileges and no user interaction, and the attack is local, so the risk is mainly relevant after an attacker already has a foothold on the system.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7711 (scope conflicts between sources, verify on MSRC)
• Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9974
• Windows Server editions: Unknown.

Fixed in

• Builds at or above the thresholds listed under affected, delivered with the November 2026 security update (Patch Tuesday, 10 November 2026).
• KB numbers: Unknown.

Workaround

Unknown. No vendor-documented workaround found.

Exploitation

• Not marked as exploited in the wild.
• Publicly disclosed: No.
• Microsoft exploitability index: Exploitation Less Likely (per Rapid7 summary).
• No public proof of concept found; absence of evidence is not proof that none exists.

Our recommendation

• Install the November 2026 cumulative update on Windows 10 and 11 systems, starting with hosts that run Windows containers.
• Verify the installed build against the MSRC advisory, especially for Windows 11 23H2.
• Limit local logon to trusted users and review accounts on container hosts.
• Apply through the normal monthly cycle; the priority is lower than for Important or actively exploited issues in the same release.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record (Microsoft CNA) www.cve.org
• Microsoft Security Update Guide (MSRC advisory) msrc.microsoft.com
• Rapid7 Patch Tuesday, November 2026 www.rapid7.com
• Strix.ai CVE summary (third-party) www.strix.ai
• Microsoft MSRC November 2026 security update blog www.microsoft.com
• MSRC Security Update Guide FAQs www.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:58.