Windows Overlay Filter EUVD-2026-99114

Exploitation requires the attacker to already have a valid, interactive foothold on the target Windows machine (AV:L) with at least low-level user privileges (PR:L) - it is not remotely reachable and needs no user interaction by a victim. The specific condition is local access to the Windows Overlay Filter (WCIFS) driver interface to issue the operation that triggers the CWE-126 buffer over-read. Limiting factors: no remote network path, prior authenticated access is mandatory, impact is confined to confidentiality (information disclosure) with no integrity or availability effect, and CISA SSVC assesses the flaw as non-automatable, reducing the viability of scalable or worm-like abuse. All supported Windows 10/11 and Windows Server 2012-2025 builds below the patched versions listed in EUVD are affected in default configurations.

This is a genuine but comparatively low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and score of 5.5 describe a locally exploitable information-disclosure flaw that requires the attacker to already hold low-level privileges (PR:L) on the host - there is no network vector and no integrity or availability impact. All real-world exploitation signals align toward low urgency: the CISA SSVC framework records Exploitation=none, Automatable=no, and Technical Impact=partial, there is no CISA KEV listing, and no public exploit code was identified in the provided data. No EPSS score was supplied, so the quantitative exploitation probability is unknown and cannot be weighed. The signals are internally consistent - a local, authenticated, non-automatable memory over-read - rather than conflicting, so there is no high-CVSS/low-real-risk discrepancy to resolve; the moderate CVSS already reflects the limited reach. The main driver of attention is the ubiquity of Windows rather than the severity of the individual flaw; prioritize via normal Patch Tuesday cadence rather than emergency remediation.

An attacker who already has a low-privileged foothold on a Windows host (for example a standard local or RDP user, or malware running in a user context) interacts with the Windows Overlay Filter (WCIFS) driver to trigger a buffer over-read, causing adjacent kernel/process memory to be read back and disclosed. The leaked memory could contain pointers or secrets usable to bypass ASLR or stage a follow-on privilege-escalation chain. No public proof-of-concept was identified at the time of analysis, and the low attack complexity (AC:L) means a working exploit would be reliable once developed.