Windows Overlay Filter CVE-2026-69967

Exploitation requires the attacker to already have local, authenticated access to the system as at least a low-privileged user (CVSS PR:L, AV:L) and the ability to exercise the Windows Overlay Filter (WOF) code path, which handles file-system compression/overlay operations. No user interaction is needed (UI:N), and no special non-default configuration is called out - WOF is a standard Windows component present on affected versions (Windows 10 1607 through 11 26H2/26H1, and Windows Server 2012 through 2025, below the fixed builds listed in the EUVD). The principal limiting factors are the mandatory pre-existing local foothold (no remote or network exploitation) and the impact ceiling: confidentiality-only disclosure (C:H, I:N, A:N) with no code execution or integrity/availability effect, so its realistic use is as an information-leak primitive within a larger exploit chain rather than a standalone attack.

This is a genuinely moderate-priority issue, not a top-tier emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local attack by an already-authenticated low-privileged user with no user interaction, yielding high confidentiality impact but no integrity or availability impact - a pure information-disclosure primitive. CISA's SSVC decision framework corroborates low urgency: Exploitation=none (no known exploitation), Automatable=no (cannot be mass-scripted across targets because it requires pre-existing local access), and Technical Impact=partial. KEV status is NOT present, so there is no confirmed active exploitation; no POC is referenced either, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified - this is a data gap, not evidence of low risk. The signals do not conflict: a local-only, info-disclosure-only, non-automatable bug with no public exploit is a legitimate patch-in-normal-cycle item rather than a drop-everything priority. Its practical value to an attacker is as a secondary primitive - e.g., defeating ASLR or leaking kernel/driver memory to chain with a separate privilege-escalation bug - rather than a standalone compromise.

A local, low-privileged user (or malware already running in a standard user context) invokes the Windows Overlay Filter (wof.sys / WofCompressedData path) with crafted input that triggers an out-of-bounds read, causing adjacent kernel or driver memory to be returned to the caller. The leaked bytes can disclose sensitive data or memory-layout information useful for defeating ASLR in a follow-on exploit chain. No public exploit code is identified at time of analysis, and because exploitation requires existing local access and no user interaction, it is a plausible post-compromise step rather than an initial access vector.