Windows Overlay Filter CVE-2026-69373

Exploitation requires an authorized local user with high privileges (administrator-level) on the target Windows system - the CVSS PR:H metric confirms this. The attacker must have the ability to interact with the Windows Overlay Filter driver, which is loaded by default on any Windows installation using NTFS compression or WIM-backed file overlays. No network access or user interaction is required (AV:L, UI:N). The primary limiting factor is the PR:H prerequisite: this flaw cannot be exploited remotely or by an unprivileged user; it is only useful to an attacker who already controls a high-privilege local session and seeks to further escalate to SYSTEM or kernel trust level.

The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 6.7, anchoring real-world risk significantly below the full C:H/I:H/A:H impact triad would suggest in isolation. The PR:H requirement is the dominant limiting factor: exploitation requires the attacker to already hold administrator-level access on the local system, making this a post-compromise or sandbox-escape primitive rather than an initial access vector. In practice this is most relevant in multi-stage attack chains - e.g., moving from a compromised admin account to SYSTEM or kernel integrity level to disable security tooling - or in constrained environments where admins are separated from kernel-level trust. No EPSS probability is provided in the supplied data, no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, all of which further reduce near-term exploitation urgency. Organizations with mature privileged access management and least-privilege enforcement will find the realistic exploitability of this flaw considerably lower than its full-CIA impact metrics imply.

An attacker who has already obtained local administrator access on a Windows endpoint - through credential theft, lateral movement, or a prior exploit - triggers the integer overflow in the WOF kernel driver to achieve SYSTEM-level or kernel-level code execution. From that elevated context the attacker can disable endpoint detection agents, dump LSA secrets, or install a persistent kernel implant. No public exploit code has been identified at time of analysis.