Windows Overlay Filter CVE-2026-69316

Exploitation requires an authenticated local user account (PR:L) - the description explicitly states 'authorized attacker.' The high attack complexity (AC:H) indicates that exploitation is not straightforward; specific file system state, timing, or IOCTL parameter conditions must be met, making reliable exploitation substantially harder than a simple function call. The impact is read-only kernel memory disclosure; there is no write primitive or availability impact. Exploitation is constrained to the local attack surface (AV:L), ruling out remote or unauthenticated exploitation. Non-default conditions that could further limit exposure include environments where WOF-compressed volumes are absent, though WOF is enabled by default on modern Windows installations.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N accurately characterises a medium-severity local information disclosure: attack vector is local, complexity is high, and low user privileges are required, constraining exploitability to attackers who already have an interactive or remote session on the target host. Confidentiality impact is rated High because kernel memory disclosure can expose sensitive data such as credentials, cryptographic keys, or ASLR layout - making this relevant as a post-compromise reconnaissance primitive or LPE chain component rather than a standalone entry point. No EPSS score was provided in the input data, and no public exploit code or KEV designation exists, suggesting opportunistic exploitation is currently unlikely. The practical risk for most environments is low unless combined with an initial access or local privilege-escalation chain; defenders should nonetheless apply the patch promptly given the breadth of affected Windows versions and the sensitivity of kernel memory.

An attacker who has obtained a low-privileged local session - via phishing, a stolen credential, or a prior initial access - crafts a specific IOCTL call or file system operation targeting the WofFilter driver under conditions that satisfy the high attack complexity requirement, triggering the buffer over-read. The out-of-bounds kernel memory read returns adjacent memory contents, which the attacker can analyse to extract sensitive material such as kernel pointers (defeating KASLR) or credential data held in memory. No public proof-of-concept code has been identified at time of analysis.