Windows Overlay Filter CVE-2026-69343

Exploitation requires an attacker to have already obtained low-privilege code execution on the target machine (PR:L) - this is not remotely triggerable without a prior foothold. The attack vector is strictly local (AV:L); there is no network-based attack path. No user interaction is required once code is running. The Windows Overlay Filter driver (WOF) must be present and active, which is the default configuration on all listed Windows versions. No special configuration, elevated privilege, or specific feature flag beyond a standard low-privilege logon is required. The primary limiting factor is the requirement for local code execution: remote attackers must chain this with a separate initial access or code-execution vulnerability.

CVSS 5.5 Medium correctly reflects a local-only, no-integrity-impact information disclosure. The AV:L/PR:L combination means an attacker must already have code executing on the target at low privilege - this is not remotely exploitable directly. The C:H rating indicates the OOB read can yield high-value kernel memory (potentially KASLR offsets, handle tables, or credential material), making it a useful building block in a privilege escalation chain rather than a standalone critical issue. No EPSS score was provided in input data. The absence of KEV listing and public POC further suppresses urgency for most environments. The primary real-world risk scenario is a local attacker (malicious insider, post-exploitation lateral movement, sandbox escape) chaining this with a separate write primitive to achieve full LPE. The tag 'Buffer Overflow' in the input metadata is technically inaccurate - CWE-125 is a read, not a write overflow - and should not influence severity assessment.

A low-privilege local user or malware process already executing on a target Windows system sends a crafted request to the Windows Overlay Filter driver via an IOCTL or specially formed filesystem operation, triggering the out-of-bounds read. The leaked kernel memory - potentially containing KASLR base addresses or sensitive heap data - is returned to the attacker's process, providing the offset information needed to reliably target a separate kernel write primitive for full local privilege escalation to SYSTEM. No public exploit or proof-of-concept is known at time of analysis.