The Windows Overlay Filter contains an out‑of‑bounds read that can be leveraged by an attacker with local authorization to gain higher privileges. The flaw occurs when the filter processes data it should not have access to, allowing it to read beyond allocated memory and potentially influence the system’s privilege level. The impact is a local elevation of privileges, giving the attacker authority to execute actions reserved for administrators.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; Microsoft Windows Server 2012, Server 2012 R2, 2016, 2019, 2022 and 2025, and their Server Core installations are all affected.

The vulnerability has a CVSS score of 7.8, indicating that an exploitable flaw with moderate‑high risk exists. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting the attack surface is not widely known at this time. The likely attack vector is a local, authorized user exploiting the filter after gaining system access. No public exploit has been reported, but the combination of local access and privilege escalation presents a serious threat if left unpatched.