Windows Overlay Filter EUVD-2026-99353

Requires the attacker to already have local, authenticated access to the Windows host as at least a low-privileged user (PR:L) and the ability to execute code that invokes the Windows Overlay Filter (Wof) driver, which handles compressed/overlay file access and is present by default on supported Windows 10/11 and Windows Server 2016-2025 builds. Exploitation is limited by high attack complexity (AC:H): the use-after-free must be triggered by winning a race condition / timing window, so success is probabilistic and may require repeated attempts, and it is not remotely or network reachable (AV:L) and needs no user interaction from a victim (UI:N). Defenders can treat prior local foothold as the key prerequisite.

This is a genuine but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) confirms it is not remotely reachable - an attacker must already have local, authenticated access as a low-privileged user (PR:L), and the high attack complexity (AC:H) is consistent with the race-condition nature of a use-after-free (CWE-416), meaning exploitation requires winning a timing window and is not trivially reliable. All real-world exploitation signals point low: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', and there is no CISA KEV listing and no public POC in the provided data, so there is no public exploit identified at time of analysis. The counterweight is impact: SSVC Technical Impact is 'total' and CVSS rates C:H/I:H/A:H, reflecting that a successful exploit yields full SYSTEM-level compromise. Net assessment: a credible post-compromise escalation primitive (useful as a second-stage in an intrusion chain) rather than an urgent, mass-exploitable threat - patch on a normal prioritized cycle. Note the 'Denial Of Service' tag conflicts with the description, which states privilege elevation, not availability loss; treat DoS as at most a secondary failure mode of the UAF.

A low-privileged user who already has code execution on a Windows host (e.g., via phishing or a compromised standard account) runs a crafted program that repeatedly triggers and races the use-after-free in the Windows Overlay Filter driver to corrupt kernel memory. By grooming the freed object and winning the timing window, the attacker hijacks kernel control flow to elevate to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation may require many attempts.