EUVD-2026-73234
GHSA-3j3c-9mcq-x5wq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege local user triggers kernel heap overflow in default-loaded driver; no scope change; full C/I/A reflects SYSTEM-level privilege escalation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
AnalysisAI
Heap-based buffer overflow in Windows Overlay Filter (WofFilter.sys) enables a locally authenticated, low-privileged user to escalate privileges to SYSTEM across all supported Windows client and server releases. Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025, representing the full breadth of Microsoft's currently supported Windows estate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing low-privilege authenticated session on the target Windows system (PR:L per CVSS, described as 'authorized attacker' in the advisory). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation that requires no special exploitation complexity once a low-privilege foothold is obtained. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update corresponding to the installed Windows version, targeting the minimum build numbers listed above: Windows 10 21H2/22H2 to 10.0.19044/19045.7725, Windows 11 24H2/25H2 to 10.0.26100.9445 or 10.0.26200.9445, Windows Server 2025 to 10.0.26100.33438, and Server 2019 to 10.0.17763.9245, per the full table at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69368. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and enumerate all Windows 10 (1607-26H1), Windows 11, and Windows Server (2012 R2-2025) systems and segment patch deployment by criticality: domain controllers and servers first, then Tier-1 workstations (finance, HR, engineering), then general endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today