Windows Overlay Filter CVE-2026-69947

Exploitation requires physical, hands-on access to the target device (CVSS AV:P) - there is no remote or network-based attack path. The flaw lies in the Windows Overlay Filter (WOF) driver, so a crafted input must reach that component; attack complexity is low (AC:L) and no authentication or privileges are required (PR:N), and no user interaction is needed (UI:N). The decisive limiting factor is the physical-access prerequisite, which prevents remote exploitation, scalable/automated attacks (SSVC Automatable=no), and worming. Affected deployments are unpatched Windows 10 (21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2022/2025 builds below the fixed versions listed in EUVD-2026-99111; applying the vendor patch removes exposure.

This is a textbook case of a high-impact flaw whose real-world risk is sharply capped by its attack vector. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8 Medium) reports total compromise of confidentiality, integrity, and availability, but the Physical attack vector (AV:P) means an attacker must have hands-on access to the target device - eliminating remote and network-based mass exploitation. The SSVC decision framework corroborates the low-urgency reading: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted/wormed, consistent with a physical prerequisite), while Technical Impact=total matches the C:H/I:H/A:H impact set. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified; this is a data gap, not evidence of either high or low likelihood. The CVE is NOT in CISA KEV and no public POC is indicated. Net assessment: despite a 'total' technical impact, the combination of physical-only access, no automatability, and no evidence of exploitation makes this a low operational priority for most environments relative to its CVSS number - patch on normal cadence rather than emergency. The one caveat worth verifying with the vendor: PR:N (no privileges) combined with AV:P is unusual and implies an unauthenticated attacker with physical access (e.g., at a locked-screen or boot context) - confirm the precise physical preconditions in the Microsoft advisory.

An attacker with direct physical access to a Windows machine supplies specially crafted input to the Windows Overlay Filter (WOF) component, triggering a heap-based buffer overflow that corrupts memory and allows arbitrary code execution. Because the CVSS vector is AV:P/AC:L/PR:N, exploitation is low-complexity and requires no prior authentication, but it is gated entirely on hands-on physical access to the device. No public exploit code is identified at time of analysis, so any real attack would require the adversary to develop a working exploit independently.