Windows Overlay Filter EUVD-2026-73234

Exploitation requires an existing low-privilege authenticated session on the target Windows system (PR:L per CVSS, described as 'authorized attacker' in the advisory). No user interaction is required beyond the attacker executing their own code. The Windows Overlay Filter driver (WofFilter.sys) is present and loaded by default on all affected Windows installations - no optional feature flag, non-default configuration, or specific application must be running. Exploitation is strictly local (AV:L); a remote attacker cannot exploit this vulnerability directly without first obtaining local code execution through a separate vulnerability or credential compromise.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation that requires no special exploitation complexity once a low-privilege foothold is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, limiting the urgency signal; however, the low attack complexity and no-user-interaction requirement make it a natural post-exploitation tool for threat actors who gain initial access. The extraordinarily broad version coverage - every supported Windows 10/11 client variant and every supported Server release from 2012 R2 through 2025 - means virtually any unpatched Windows environment in any organization is exposed. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be assessed. The primary limiting factor is the requirement for existing low-privilege local code execution, meaning this vulnerability cannot be weaponized remotely without a separate initial access vector.

A low-privileged attacker who has gained a foothold on a Windows workstation or server - for example via a phishing-delivered payload or stolen credentials - crafts a malicious filesystem operation targeting WofFilter.sys to trigger the heap overflow, corrupts kernel memory structures, and redirects kernel execution to achieve SYSTEM-level privileges. From SYSTEM, the attacker can disable security tooling, dump credentials, and move laterally. No public proof-of-concept has been identified at time of analysis.