Windows Overlay Filter CVE-2026-69950

Exploitation requires the attacker to already possess authenticated, low-privileged local access to the target Windows system (PR:L, AV:L) and the ability to invoke the Windows Overlay Filter (WOF) driver, which is present by default across all supported Windows client and server editions. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is the local-access prerequisite: the flaw cannot be triggered remotely and only serves to elevate privileges from an existing foothold, so it is not usable for initial compromise.

This is a credible but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) describes a local elevation-of-privilege flaw requiring an attacker to already have low-level authenticated access to the host - it is not remotely exploitable. The signals are internally consistent and point toward lower immediate urgency: CISA's SSVC decision framework lists Exploitation as 'none' and Automatable as 'no', meaning no observed exploitation and no reliable mass-automation path, even though Technical Impact is 'total'. There is no CISA KEV listing and no public exploit identified in the provided data, so this is no public exploit identified at time of analysis. No EPSS score was supplied, so exploitation probability cannot be quantified here. The combination of total technical impact with a local-only, authenticated vector is the classic profile of a post-compromise privilege-escalation link in an attack chain rather than an initial-access vulnerability - valuable to an attacker who already has a foothold, but not a drive-by remote threat.

An attacker who has already gained low-privileged, authenticated code execution on a Windows host (e.g., via phishing or a separate initial-access bug) invokes the Windows Overlay Filter (WOF) driver with crafted input that triggers a buffer over-read, corrupting or leaking kernel memory to elevate to SYSTEM. No user interaction is required and attack complexity is low. No public proof-of-concept exploit code is identified in the available data.