Windows Overlay Filter EUVD-2026-99116

Exploitation requires PHYSICAL access to the target device (CVSS AV:P): the attacker must be able to physically interact with the machine to deliver input processed by the Windows Overlay Filter (WOF), the Windows component used for compressed/overlay file access. No authentication is required once physical access is obtained (PR:N) and no user interaction is needed (UI:N), and attack complexity is low (AC:L). The dominant limiting factor is the physical-access prerequisite, which prevents remote or scalable exploitation (SSVC Automatable: no) and confines realistic risk to physically exposed, shared, or unattended endpoints; the device must also run an unpatched affected build (e.g., Windows 11 24H2 <10.0.26100.9711 or Windows Server 2025 <10.0.26100.33650).

This is a high-CVSS component (C:H/I:H/A:H, total technical impact per SSVC) whose real-world priority is substantially blunted by the attack vector. The CVSS 3.1 vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H specifies a PHYSICAL attack vector (AV:P), meaning the attacker must have physical or near-physical access to the target device - not network or even local-logon access. All exploitation signals point AWAY from urgency: SSVC Exploitation status is 'none', Automatable is 'no' (consistent with a physical prerequisite that cannot be scripted at scale), and there is no KEV listing and no public exploit identified. EPSS is not provided in the input. The signals are internally consistent rather than conflicting: a serious memory-corruption impact gated behind a physical-access requirement. This is therefore a genuine code-execution flaw but a LOW-to-MODERATE real-world priority for most fleets - patch in normal cadence, with elevated priority only for physically exposed or shared-access devices (kiosks, lab machines, unattended endpoints). Note: although CVSS shows PR:N (no authentication), the physical vector effectively limits exposure to those who can touch the hardware.

An attacker with physical access to an unlocked or accessible Windows device presents crafted input (e.g., attached storage or a locally supplied file) that is processed by the Windows Overlay Filter, triggering a heap-based buffer overflow and allowing arbitrary code execution. No public exploit code or active exploitation has been identified at time of analysis, and the low attack complexity (AC:L) means that once physical access is obtained, no special timing or conditions are needed.