Windows Overlay Filter CVE-2026-69371

Exploitation requires an authenticated low-privileged account (local or network) on or with network access to the target system (PR:L per CVSS), consistent with Microsoft's 'authorized attacker' language. User interaction is required (UI:R per CVSS), meaning a victim user on the target must perform a triggering action - such as opening, navigating to, or mounting a network path that causes the WoF driver to process attacker-supplied compressed overlay data. The WoF driver is enabled by default on all affected Windows versions and does not require a non-default configuration to be exploitable. Exploitation is constrained by: (1) the need for at least a low-privilege account - unauthenticated remote exploitation is not possible; (2) the requirement for victim interaction, adding a social engineering or timing dependency; and (3) affected build versions only - patched systems are not vulnerable. The combination of PR:L and UI:R meaningfully reduces real-world exploitability compared to a fully unauthenticated, no-interaction network exploit.

The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a meaningful but somewhat constrained attack: the low-privilege authentication requirement (PR:L) and mandatory user interaction (UI:R) prevent fully unauthenticated, zero-touch exploitation. The network attack vector (AV:N) and low complexity (AC:L) elevate urgency since no specialized toolchain or unusual configuration is required beyond network access and a low-privilege account. Full C:H/I:H/A:H impact in an unchanged scope is consistent with kernel-level privilege escalation to SYSTEM, which is a high-value attacker objective. EPSS data is not present in the provided input, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no public POC code have been identified, suggesting this was vendor-discovered rather than exploited in the wild. Given the ubiquitous Windows deployment footprint and the value of SYSTEM-level access as a pivoting or persistence capability, the patch should be treated as high priority in enterprise environments despite the absence of confirmed active exploitation.

An attacker with a low-privileged domain or local account crafts a network file-system operation - for example, accessing a specially structured compressed file or overlay path - that causes the WoF kernel driver on the target Windows system to process attacker-controlled data beyond the bounds of a heap buffer. The triggered heap overflow corrupts adjacent kernel memory, enabling the attacker to overwrite a function pointer or security token structure and redirect execution to shellcode running at SYSTEM privilege. No public exploit code has been identified at time of analysis, but the low complexity rating suggests the primitive is reliable once a working heap layout is achieved.