Windows Overlay Filter CVE-2026-96315

Exploitation requires the attacker to already have authenticated local execution on the target Windows host at a low privilege level (PR:L, AV:L) - there is no network vector and no path from an unauthenticated or remote position. No user interaction is needed (UI:N) and the issue affects default configurations of the Windows Overlay Filter (WOF) across all listed supported Windows 10/11 and Windows Server 2016-2025 builds below the patched versions, so no special feature toggle is documented. The decisive limiting factor is the mandatory pre-existing local, authenticated foothold, which confines this to post-compromise or malicious-insider scenarios; impact is limited to integrity/tampering with no confidentiality or availability loss.

This is a moderate-severity, low-urgency issue rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 5.5) describes a locally-exploitable tampering flaw requiring the attacker to already hold low-level authenticated access to the host; there is no network reachability, no privilege-free entry, and no confidentiality or availability impact - only integrity (I:H). All signals point the same direction and reinforce low real-world urgency: CISA's SSVC decision shows Exploitation=none, Automatable=no, and Technical Impact=partial, which maps to a 'Track' rather than 'Act' disposition. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' The one note of friction is the 'Authentication Bypass' tag, which conflicts with the actual weakness: this is CWE-862 Missing Authorization leading to tampering, NOT an authentication bypass - defenders should not treat this as a credential/auth-bypass primitive. Bottom line: a real but low-priority local integrity flaw affecting an enormous install base; patch on a normal cycle, not out-of-band.

A low-privileged but authenticated local user on a Windows machine abuses a missing authorization check in the Windows Overlay Filter (WOF) component to modify or tamper with data or state they should not be permitted to alter. No remote access, user interaction, or administrative rights are needed beyond the initial low-privilege foothold, but the attacker must already be executing code locally. No public exploit code was identified at the time of analysis.