Windows Overlay Filter CVE-2026-105004

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the target (CVSS PR:L, AV:L) - this is a local privilege-escalation primitive, not a remote entry point. The specific prerequisite is the ability to invoke the Windows Overlay Filter (WOF) kernel component and supply input that triggers the out-of-bounds read; WOF is present by default on Windows, so no non-default configuration appears necessary. The principal limiting factor is the need for a pre-existing local foothold: a remote attacker cannot use this directly and must first gain standard-user execution through another vector. No user interaction is required (UI:N).

This is a locally-exploitable elevation-of-privilege flaw in the Windows Overlay Filter (wof.sys) driver, rated CVSS 7.8 (High). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local attack vector, low complexity, and that the attacker must already hold low-level privileges (PR:L) - i.e., code execution as a standard user on the target host. There is no network-facing exposure. No EPSS score was provided in the input, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so by the precision rules this is 'no public exploit identified at time of analysis.' Despite the high CVSS driven by full C/I/A kernel impact, the real-world priority is moderate rather than urgent: exploitation requires prior local access and no active exploitation or POC is evidenced. The signals are internally consistent (local EoP, authenticated low-priv) with no conflicts, though the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified. Treat as a standard Patch-Tuesday-class kernel EoP: patch in normal cycle, prioritize on shared/multi-user and high-value hosts where a local foothold could be chained to SYSTEM.

An attacker who already has low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a separate RCE) runs a crafted program that triggers an out-of-bounds read in the Windows Overlay Filter driver to corrupt or disclose kernel memory and elevate to SYSTEM. No user interaction is required and attack complexity is low (AV:L/AC:L/UI:N), but local access is a prerequisite. No public exploit code is identified at time of analysis.