Windows Overlay Filter EUVD-2026-99108

Exploitation requires the attacker to already have LOCAL access to the host AND low-level authenticated privileges (PR:L) - no remote or network path exists (AV:L). The attacker must be able to execute code or a process that reaches the Windows Overlay Filter (WOF) driver, the component that handles compressed/overlay file storage (used by Windows Compact OS and WIM-backed files). No user interaction by a victim is needed (UI:N). The key limiting factors are the mandatory local foothold and pre-existing account, which confine this to privilege-escalation/post-exploitation use; it cannot serve as an initial access vector. Affected builds are specific per EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2022 <10.0.20348.5761, Server 2025 <10.0.26100.33650), so fully patched systems are not exploitable.

All signals point to a genuine but non-urgent, lower-priority local vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) confirms this requires LOCAL access and existing low-level privileges (an authenticated/authorized attacker already on the machine) - it is not remotely exploitable. The 7.8 HIGH base score is driven almost entirely by the total technical impact (C:H/I:H/A:H), which the CISA SSVC assessment independently corroborates (Technical Impact: total). However, the same SSVC framework rates Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no', meaning it cannot be reliably scripted into mass/wormable attacks. No EPSS score was provided in the input, and there is no CISA KEV listing and no public POC, so there is no evidence of real-world weaponization. This is a classic high-CVSS-but-low-real-risk profile for most environments: high impact IF triggered, but gated behind local access and low automatability, making it a privilege-escalation/post-compromise concern rather than an initial-access threat. No signals are in conflict - the local vector, authenticated requirement, and 'none/no' SSVC values all align.

An attacker who already has a low-privileged authenticated foothold on a Windows host (e.g., via phishing or a prior compromise) runs a crafted local process that supplies malformed input to the Windows Overlay Filter (wof.sys), triggering a buffer over-read (CWE-126). By grooming memory and leveraging the out-of-bounds read, the attacker achieves local code execution to escalate privileges. No public exploit code has been identified at time of analysis, and the attack cannot be performed remotely or without an existing account.