EUVD-2026-73480
GHSA-59qv-g73w-92x7
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only attack requiring high privileges; integer overflow in kernel driver yields full kernel-level CIA impact once exploited.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
AnalysisAI
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authorized local user with high privileges (administrator-level) on the target Windows system - the CVSS PR:H metric confirms this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 6.7, anchoring real-world risk significantly below the full C:H/I:H/A:H impact triad would suggest in isolation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update delivered via Windows Update or WSUS corresponding to the patched build for each affected version: Server 2012 R2 to 6.3.9600.23397, Server 2016/Windows 10 1607 to 10.0.14393.9512, Server 2019/Windows 10 1809 to 10.0.17763.9245, Server 2022 to 10.0.20348.5622, Windows 10 21H2 to 10.0.19044.7725, Windows 10 22H2 to 10.0.19045.7725, Windows 11 23H2 to 10.0.22631.7582, Windows 11 24H2 and Server 2025 to 10.0.26100.9445 (desktop) or 10.0.26100.33438 (server), Windows 11 25H2 to 10.0.26200.9445, and Windows 11 26H1 to 10.0.28000.2954. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today