Windows Overlay Filter CVE-2026-69474

The attacker must hold a valid low-privilege account on the target system or domain (PR:L). A user on the target system must perform some interaction to trigger the vulnerable code path in OverlayFilter.sys (UI:R). High attack complexity (AC:H) indicates a race condition or non-trivial trigger sequence that prevents simple, reliable automated exploitation. The Windows Overlay Filter driver must be loaded, which is broadly true on modern Windows but especially relevant in container-capable and WSL-enabled deployments. Exploitation is limited to information disclosure only - no integrity modification or availability disruption results (I:N/A:N).

CVSS 4.8 Medium (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) correctly positions this as a moderate-priority item. High attack complexity (AC:H) signals a race condition or precise trigger sequence rather than a straightforward one-shot exploit, meaningfully reducing automation potential. The authenticated prerequisite (PR:L) requires a valid account, and user interaction (UI:R) adds a further dependency on victim-side behavior. Impact is bounded to confidentiality (C:H), with no integrity or availability effect - limiting the operational damage even in a successful attack. No KEV listing and no identified POC reinforce that mass exploitation is not currently observed. EPSS data was not included in the provided intelligence. The breadth of affected Windows versions - from the decade-old Server 2012 R2 through the current Server 2025 and Windows 11 26H1 - gives this vulnerability a wide potential exposure surface, particularly in environments with delayed patch cycles. Vendor-released fixes are available for all listed affected versions, making patching the straightforward risk reduction path.

An authenticated low-privilege attacker with network access to a target Windows host sends crafted requests that trigger a race condition in the Overlay Filter driver during a user-initiated filesystem operation. Precise timing causes the driver to access previously freed kernel memory, and the stale contents - potentially including privileged data structures or cached credentials - are returned across the network connection to the attacker.