Buffer over‑read exploitation in the Windows Overlay Filter component allows an attacker with authorized local access to execute arbitrary code on the device. The flaw arises from improper handling of buffer boundaries, resulting in reading beyond allocated memory and enabling code injection. This flaw is a CWE‑126: Buffer Over‑read. An attacker who can trigger the vulnerable operation can run malicious code with the privileges of the user executing the process.

This vulnerability impacts multiple Microsoft Windows releases. Affected operating systems include Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core installations). Certain ARM‑64 builds of Windows 11 26H2 are also affected. The full list of affected variants is enumerated in the Microsoft Security Advisory.

The CVSS score of 7.8 indicates a high‑severity local code‑execution risk. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is considered local, requiring an authorized user or process to trigger the vulnerable overlay operation; the public description does not detail a remote exploitation path. No public exploit is currently known, but the high CVSS and low EPSS imply a moderate likelihood of future exploitation. The likely attack vector is inferred to be a local privileged user executing code that invokes the Overlay Filter.