Microsoft Windows CVE-2026-54987

Exploitation requires the attacker to already have local, authenticated access as a low-privileged user (CVSS PR:L, AV:L) able to run code that interacts with the Windows Overlay Filter (wof.sys) - the driver backing transparent NTFS file compression / Compact OS. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local-access and low-privilege prerequisites confine this to post-compromise scenarios: it cannot be triggered remotely or by an unauthenticated attacker. The WOF driver is present by default on all listed Windows client and server SKUs, so no non-default configuration is needed once local access is obtained.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning local access and low privileges are required, no user interaction is needed, and successful exploitation yields full confidentiality, integrity, and availability impact - the classic profile of a kernel elevation-of-privilege bug used as a post-compromise second stage. No EPSS score, SSVC decision, or KEV entry was provided in the input; it is not confirmed actively exploited and no public exploit was identified at time of analysis, so this is currently a patch-on-normal-cadence issue rather than an emergency. The signals are internally consistent (Microsoft-reported, local vector, low complexity), but practical risk is bounded because an attacker must already have code execution as a standard user on the host; the primary value is converting a foothold into SYSTEM. No conflicting data was observed, though the absence of EPSS/SSVC means widespread-exploitation likelihood cannot be quantified from the provided data.

An attacker who has already gained standard-user code execution on a Windows host - for example via phishing, a compromised application, or stolen credentials - invokes the Windows Overlay Filter with crafted input that overflows a kernel heap allocation, corrupting adjacent pool memory to hijack kernel execution and elevate to SYSTEM. With AV:L/AC:L/PR:L/UI:N, this needs no victim interaction and only low privileges, making it a reliable local privilege-escalation step. No public proof-of-concept was identified at time of analysis.