Windows Overlay Filter EUVD-2026-99404

Requires the attacker to already hold valid local, low-privileged credentials/code execution on the target Windows system (AV:L, PR:L) - this is not remotely reachable. Exploitation depends on winning a timing-sensitive race condition in the Windows Overlay Filter (CWE-362), reflected by AC:H, which means success is probabilistic and may require many attempts; no user interaction is needed (UI:N). The Windows Overlay Filter is a standard OS driver present on default installations across supported Windows client and server builds, so no special non-default feature or configuration is required beyond local access. Limiting factors for defenders: mandatory prior local access, no remote vector, and the inherent unreliability of race-condition exploitation (CISA SSVC marks it Automatable=no).

This is a locally-exploitable elevation-of-privilege flaw in the Windows Overlay Filter (WOF) driver, with signals that collectively point to a moderate - not emergency - priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) confirms the attacker must already have local, authenticated access (PR:L) and must win a timing-sensitive race (AC:H), which materially lowers reliability of exploitation despite the total (C:H/I:H/A:H) impact. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a race condition that cannot be reliably scripted at scale), but Technical Impact=total (full compromise if the race is won). No EPSS score was provided in the input, and KEV status is not listed (treat as not-KEV); POC availability is likewise not indicated. The signals are therefore internally consistent rather than conflicting: high technical impact but constrained, unreliable, local-only exploitation. The honest read is a credible-but-not-urgent privilege-escalation bug - valuable as a second-stage tool for an attacker who already has a foothold, but not a mass-exploitation threat. Note: the 'Information Disclosure' tag is inconsistent with the description, which characterizes the flaw purely as local privilege elevation; the C:H component of the CVSS vector is the only supporting signal for a disclosure angle.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a standard user account) runs a crafted local program that repeatedly triggers the Windows Overlay Filter operation to win a timing race. On a successful race, the flaw grants SYSTEM-level privileges, enabling full host compromise. No public exploit code was identified at the time of analysis, and the AC:H timing requirement makes reliable exploitation non-trivial.