The CVSS 7.8 score for this kernel-mode UAF in the Windows Bind Filter Driver almost certainly understates the actual risk. The vulnerability provides a direct path to arbitrary code execution at SYSTEM privilege, and the 'authorized attacker' language in the description obscures how many enterprise workflows involve code running at or near kernel privilege — antivirus, VPN clients, virtualization layers, and network monitoring agents all require this access. In practice, the authorization boundary is thinner than the CVE suggests.
The Bind Filter Driver occupies a uniquely dangerous architectural position. It sits at a network binding interception point, meaning exploitation doesn't just mean SYSTEM privileges — it means SYSTEM privileges with privileged access to the Windows networking stack's state machine. An attacker who compromises this driver potentially owns the endpoint's entire network personality, enabling injection of malicious payloads into traffic before encryption, before most EDR hooks fire, and before authentication stacks validate anything. This fundamentally changes the blast radius from local privilege escalation to a network pivot point.
The historical record matters here. Bind Filter Driver UAFs cluster around consistent code paths — attach/detach operations, reference count races in IRP completion callbacks, and binding engine state transitions. The driver exists partly to maintain compatibility with deprecated networking layers (legacy DHCP interactions, older NDIS patterns) that receive minimal development scrutiny. These forgotten compatibility paths are where reliable exploitation primitives live.
What to do: treat this as a high-priority patch regardless of the CVSS score. Prioritize endpoint assets running third-party network filter drivers, VPN clients, or network monitoring agents. Extend detection signatures beyond standard LPE behavior — monitor for abnormal network stack state changes from processes that shouldn't be manipulating binding infrastructure. If your threat intelligence history includes filter driver exploitation patterns, this should map to an existing profile. The 90-day disclosure window assumes rapid remediation; kernel driver patches face longer organizational testing cycles, meaning the actual exploitation window extends well beyond disclosure.