Windows Overlay Filter CVE-2026-69350

Exploitation requires a locally authenticated attacker holding high-privilege access (PR:H) on the target Windows system, such as an account in the local Administrators group or an equivalent high-integrity process. The vulnerable Windows Overlay Filter driver (WOF) is present and active by default on all standard Windows installations - no special non-default configuration is necessary to expose the vulnerable code path. No network access or user interaction is required once the attacker has local high-privilege access. The principal limiting factor is the PR:H prerequisite: this vulnerability cannot serve as an initial access vector and is only relevant as a privilege escalation step within an already-compromised system, for example to elevate from administrator to SYSTEM for purposes of bypassing endpoint detection tools or achieving persistence mechanisms that require kernel-level access.

The CVSS 3.1 score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately captures that exploitation is constrained to attackers who already hold high-privilege local access, meaningfully narrowing the threat population - even a mid-sized municipal IT team in kalisz should treat this as a routine patch-Tuesday hardening priority rather than an emergency incident response trigger, given the PR:H prerequisite essentially limits risk to insider threats or second-stage post-exploitation activity. The full C:H/I:H/A:H triad reflects the kernel-level impact once triggered, but that impact is only reachable by an actor who has already cleared the substantial bar of obtaining administrator-level access. No public POC has been identified and the vulnerability is not listed in the CISA KEV catalog, keeping the EPSS-equivalent real-world exploitation signal low. The primary real-world concern is use within an established attack chain - for example, an adversary who gained admin access via credential theft using this vulnerability to move from administrator to SYSTEM and evade endpoint detection tools that distinguish between those privilege levels.

An attacker who has already obtained local administrator-level access on a Windows host - for example by cracking a stolen credential or exploiting a separate initial-access vulnerability - crafts a specific filesystem interaction targeting the Windows Overlay Filter driver to trigger the heap buffer overflow. The overflowed write corrupts adjacent kernel heap structures, enabling the attacker to redirect kernel execution and achieve SYSTEM-level privileges, bypassing endpoint controls that differentiate administrator from SYSTEM contexts. No public proof-of-concept has been identified at time of analysis.