Windows Overlay Filter EUVD-2026-99117

Exploitation requires the attacker to already hold local, authenticated access to the target Windows host with at least low-level privileges (CVSS PR:L) and the ability to execute code or invoke the Windows Overlay Filter (WOF) driver, which handles compressed/overlay file operations. No victim user interaction is needed (UI:N) and no network path exists (AV:L), so remote unauthenticated exploitation is NOT possible. Limiting factors: the requirement for a pre-existing local foothold, the authorized-user prerequisite, and SSVC Automatable=no all constrain this to a privilege-escalation/post-compromise scenario on supported Windows versions below the patched builds listed in the EUVD matrix.

This is a moderate-priority, locally-exploitable elevation-of-privilege/code-execution flaw rather than a remotely-wormable emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms it requires local access with at least low-level privileges already on the host, which caps the base score at 7.8 (High) despite total C/I/A impact. CISA's SSVC framework reinforces lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (an attacker cannot easily mass-automate this because it needs an existing authenticated foothold), though Technical Impact=total aligns with the C:H/I:H/A:H impact. EPSS is not provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC indicated, so this is not a confirmed in-the-wild threat. The description labels the root cause an out-of-bounds READ (CWE-125), which typically yields information disclosure, yet Microsoft rates full code execution with high integrity and availability impact - note this apparent tension: a pure OOB read reaching code execution usually requires chaining the leak with another primitive, so the 'execute code locally' outcome likely reflects Microsoft's worst-case assessment; verify exploitation mechanics with the MSRC advisory. Overall: patch in normal cycle, prioritize on multi-user or shared Windows hosts where a low-privileged attacker gaining full code execution would breach a trust boundary.

A low-privileged but authenticated user (or malware already running under a standard user account) on an affected Windows system invokes the Windows Overlay Filter (WOF) with crafted input that triggers an out-of-bounds read, which is leveraged to execute arbitrary code at a higher integrity level. No remote access and no user interaction by a victim are required, but the attacker must already have local code-execution or logon rights on the box. No public exploit code or active exploitation has been identified at time of analysis.