Windows Overlay Filter CVE-2026-50409

Exploitation requires a valid low-privileged local user account on the target Windows system (CVSS PR:L, AV:L) - remote unauthenticated exploitation is not possible. No non-default configuration is documented as required: the Windows Overlay Filter driver (WofFilter.sys) is a standard inbox component loaded by default on all affected Windows versions, meaning any system running one of the listed builds is potentially affected without any special feature enablement. Exploitation is not automatable per SSVC, indicating it likely requires targeted interaction with the driver rather than a fire-and-forget network scan. The scope-unchanged (S:U) rating confines impact to the vulnerable component, so privilege escalation to SYSTEM or lateral movement are not direct outcomes - disclosed data would need to be leveraged in a follow-on step. The primary limiting factor is the requirement for an existing authenticated local session.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a constrained but meaningful risk profile: local attack vector limits exposure to already-authenticated users, while C:H signals potentially sensitive data in scope. EPSS of 0.36% at the 28th percentile is low, indicating the broader threat actor community has not operationalized this vulnerability. SSVC reinforces this: exploitation is rated none, automatable is no, and technical impact is partial - all pointing toward a lower-priority item in most patch queues. No CISA KEV listing and no known POC further reduce urgency. The real-world priority is elevated in multi-user or shared-resource environments (Terminal Server, VDI, containerized workloads on Windows) where a low-privileged user sharing a host with sensitive overlay-backed workloads could extract information across isolation boundaries. For single-user endpoints, impact is substantially lower. There are no conflicting signals in the available data - CVSS, EPSS, and SSVC are all internally consistent.

A standard domain user with an active local session on a shared Windows Server 2022 system submits crafted IOCTL requests to the Windows Overlay Filter driver, triggering the CWE-200 disclosure path. The attacker reads data from kernel structures or overlay-backed file regions that are accessible to higher-privileged processes - such as cached credentials, application secrets stored in container layers, or other in-memory sensitive content - and uses that data to pivot to higher-privilege access. No public proof-of-concept exists at time of analysis, and low EPSS suggests this has not been operationalized by known threat actors.