Windows Overlay Filter EUVD-2026-99113

Exploitation requires the attacker to already have local, authenticated access with the ability to execute code as a low-privileged user (PR:L) on the target Windows system - this is an elevation-of-privilege flaw, not a remote entry point. The specific trigger is the Windows Overlay Filter component (the WOF driver underpinning compressed/overlay file handling), so the attack surface is present wherever that filter is active, which is effectively all default Windows 10/11 and Windows Server 2012-2025 installations below the fixed builds listed in EUVD. Limiting factors: no remote or network vector (AV:L), no user interaction needed (UI:N), but a valid local user context is mandatory, and patched builds (e.g., 10.0.26100.9711 for 24H2) remove the vulnerable code path.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity attack that requires the attacker to already hold valid low-privilege credentials on the host, which caps the base score at 7.8 (High) despite the total C:H/I:H/A:H impact. CISA's SSVC framework reinforces a measured posture: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (consistent with a local EoP that cannot be mass-scanned or wormed), while Technical Impact is 'total' - matching the full CIA compromise once exploited. There is no CISA KEV listing and no EPSS score was supplied, so there is no quantitative exploitation-probability signal; the SSVC 'Exploitation: none' is the strongest available indicator and points to no active exploitation. No POC was provided. The signals are internally consistent - a high-impact local privilege escalation that is not currently being exploited and is not automatable - so this is a patch-in-normal-cycle item rather than an emergency, though its ubiquity on Windows warrants prompt remediation. Note the absence of EPSS data is a gap: prioritization relies on SSVC and CVSS alone.

An attacker who has already gained a foothold on a Windows host as a standard (low-privilege) user runs a crafted program that triggers a buffer over-read in the Windows Overlay Filter (wof.sys/overlay filter driver), leveraging the out-of-bounds read to corrupt or disclose kernel memory and escalate to SYSTEM. No user interaction is required and attack complexity is low, but local code execution as an authenticated user is a prerequisite. No public exploit code has been identified at time of analysis.