A heap‑based buffer overflow exists in the Windows Overlay Filter that can be triggered by an attacker with local physical access. If successfully exploited, the flaw permits execution of arbitrary code with the privileges of the user or system context that owns the overlay filter service, potentially leading to full system compromise.

Windows 10 Version 21H2 and 22H2, Windows 11 Versions 23H2, 24H2, 25H2, 26H2, Windows 11 Version 23H2, Windows 11 Version 26H1, Windows Server 2022, Windows Server 2025, including Server Core installations. The affected builds encompass both x86 and x64 architectures as well as ARM64 variants.

The vulnerability receives a CVSS score of 6.8, indicating medium severity. No EPSS value is provided, so the likelihood of exploitation in the wild is unknown, and the flaw is not listed in the CISA KEV catalog. The description implies that a physical presence on the target machine is required, suggesting that exploitation would generally be limited to users who can physically access the device. However, should an attacker gain local access, they could exploit the overlay filter to execute payloads.