Windows Overlay Filter CVE-2026-69957

Exploitation requires the attacker to already have local, authenticated access with the ability to execute code at a low privilege level on the target (PR:L, AV:L) - it is not remotely reachable and needs no user interaction (UI:N). The specific trigger is an operation that drives an integer overflow/wraparound in the Windows Overlay Filter (WOF) component; the terse MSRC description does not name an exact feature toggle or non-default setting, and WOF is a standard OS filter driver present in supported Windows builds, so no special configuration is indicated. Limiting factors that reduce real-world risk: the mandatory pre-existing local foothold, the authentication/privilege requirement, the fact that it is not network-automatable (SSVC Automatable=no), and that patched builds exist for all affected SKUs (e.g. Windows 11 24H2 fixed in 10.0.26100.9711, Server 2022 in 10.0.20348.5761).

This is a locally-exploitable elevation-of-privilege flaw in the Windows Overlay Filter (WOF) driver, grounded in an integer overflow/wraparound (CWE-126). The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent: the attack is local (AV:L), low complexity (AC:L), requires the attacker to already hold some privileges (PR:L, i.e. authenticated), needs no user interaction, and yields total confidentiality/integrity/availability impact within the same scope - consistent with a kernel-mode privilege escalation to SYSTEM. CISA's SSVC framework reinforces a measured priority: Exploitation=none (no observed exploitation), Automatable=no (local, requires prior foothold, so not mass-scannable/wormable), and Technical Impact=total (matches the C:H/I:H/A:H kernel compromise). No CISA KEV listing and no POC are indicated in the input, and no EPSS score was supplied, so widespread or imminent exploitation is not evidenced. The signals are therefore aligned rather than conflicting: a genuinely high-impact local EoP that is valuable as a post-compromise/chaining primitive, but not an internet-facing, self-propagating emergency. Priority is driven by the ubiquity of Windows and total impact, tempered by the local-only, authentication-required precondition. Patch-now via normal Patch Tuesday cadence, prioritizing multi-user, shared, and high-value hosts.

An attacker who has already gained low-privileged code execution on a Windows host (e.g. via phishing, a compromised standard user account, or a web-tier foothold) runs a crafted program that triggers the integer overflow in the Windows Overlay Filter driver to corrupt kernel memory and elevate to SYSTEM. Because the CVSS vector is AV:L/AC:L, no network access or user interaction is needed, only local low-privileged execution. No public exploit identified at time of analysis, so weaponization would currently require original exploit development.