Windows Overlay Filter CVE-2026-83727

Requires the attacker to already hold an authenticated, low-privileged local session on the target (PR:L, AV:L) and the ability to run arbitrary code locally to reach the Windows Overlay Filter (WOF) driver - WOF is enabled by default on modern Windows, so no special feature toggle is needed, but the flaw cannot be reached remotely or without local execution. Limiting factors that reduce real-world risk: it is useless for initial access (must be chained after an existing foothold), requires no user interaction but does require valid local credentials/session, and SSVC marks it non-automatable. Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 below the listed patched build numbers; fully patched builds are not exploitable.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, 7.8 HIGH) is internally consistent with a local privilege-escalation flaw: it requires local access and an already-authenticated low-privileged foothold (PR:L), but low complexity and no user interaction once that foothold exists. The description ('authorized attacker to elevate privileges locally') corroborates the vector - no conflict between the CVSS and the text here. The signals converge on 'not an emergency': SSVC reports Exploitation=none and Automatable=no, meaning CISA sees no observed exploitation and the flaw cannot be reliably mass-automated (it needs pre-existing local access, not a network-reachable entry point). It is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The one signal that elevates it is SSVC Technical Impact=total, matching C:H/I:H/A:H - successful exploitation yields full SYSTEM-level control. EPSS is not supplied in the input and therefore cannot be factored in. Net: a real, patch-worthy EoP typically used as a post-compromise chaining step rather than an initial access vector; prioritize in normal Patch Tuesday cadence, escalating only for high-value multi-user or terminal-server hosts where untrusted users hold local sessions.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g. via phishing, a standard user account, or a prior foothold) runs a crafted local program that triggers the buffer over-read in the Windows Overlay Filter (wof.sys) driver. By manipulating the out-of-bounds read, the attacker corrupts or leaks kernel-controlled data to escalate to SYSTEM. No public exploit code is identified at time of analysis, and the local-only attack vector means it cannot be launched remotely without first obtaining local code execution.