CVE-2026-33098
Published: 14 April 2026
Summary
CVE-2026-33098 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33098 is a use-after-free vulnerability (CWE-416) in the Windows Container Isolation FS Filter Driver, published on 2026-04-14T18:17:31.830. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and enables local privilege escalation on affected Windows systems running this driver for container isolation.
A local attacker with low privileges (PR:L) can exploit the vulnerability with low attack complexity and no user interaction required. Successful exploitation allows arbitrary code execution with elevated privileges, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33098 provides details on patches and mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22619
Vulnerability details
Use after free in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Windows Container Isolation FS Filter Driver directly enables local arbitrary code execution with elevated privileges (LPE), mapping to T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in the Windows Container Isolation FS Filter Driver by requiring timely application of vendor-provided patches.
Implements memory protection safeguards such as DEP and ASLR to prevent unauthorized code execution from exploiting the use-after-free vulnerability.
Enforces least privilege for local users to limit the attack surface and impact of privilege escalation via the driver vulnerability.