Windows Overlay Filter CVE-2026-69952

Requires the attacker to already have authenticated, low-privileged local code execution on the target Windows host (CVSS AV:L, PR:L, UI:N) - there is no remote or network-triggerable path and no victim interaction is needed. The Windows Overlay Filter (WOF, wof.sys) is a built-in Windows component present by default across supported client and server editions, so no non-default configuration is required to reach the vulnerable code; the primary limiting factor is the prerequisite local foothold, and per CISA SSVC the attack is not automatable, indicating reliable exploitation requires non-trivial, likely bespoke, exploit development.

This is a locally-exploitable elevation-of-privilege flaw whose CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: an 'authorized' (PR:L) attacker already running code on the host triggers an out-of-bounds read (CWE-125) in the Windows Overlay Filter (wof.sys) to elevate. The exploitation signals are notably benign: CISA's SSVC decision shows Exploitation=none and Automatable=no, there is no CISA KEV listing, and no public exploit code is referenced - so despite a HIGH severity rating, the real-world urgency is moderate rather than acute. The one aggravating signal is SSVC Technical Impact=total, consistent with the C:H/I:H/A:H full-impact rating. Note a mild internal tension worth flagging: the root weakness is an out-of-bounds READ (typically an information-disclosure/confidentiality primitive), yet Microsoft assigns full Integrity and Availability impact as well - this reflects Microsoft's standard EoP scoring where the leaked data (e.g., kernel addresses/tokens) is leveraged into full SYSTEM control, not three independent impacts; verify against the MSRC advisory if precise impact decomposition matters. Overall: a legitimate patch-soon kernel EoP for Windows fleets, but not a drop-everything item absent evidence of exploitation.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or an initial RCE) invokes the vulnerable Windows Overlay Filter code path to trigger an out-of-bounds read, leaking kernel memory that is then used to escalate to SYSTEM. No public exploit code is identified at time of analysis, and the attack is not automatable per CISA SSVC, implying bespoke exploit development would be required.