Buffer over-read in the Windows Overlay Filter feature permits an attacker who already has local user access to gain elevated privileges on the affected Windows installations. The flaw arises from an out‑of‑bounds read that can be manipulated to read memory beyond the intended region, effectively enabling the execution of privileged operations with the account's context. This elevation of privilege can allow the attacker to modify system configuration, install malicious software, or access sensitive data that was previously restricted.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server platforms 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their server‑core installations, are listed as affected. The vulnerability applies to the x86, x64, and arm64 architectures as identified in the known CPE entries.

The CVSS score of 7.8 indicates moderate to high severity. With no EPSS data available, the probability of exploitation cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog, implying no publicly documented exploit has been confirmed. Because the attack requires authorized local access, an attacker who is a normal user or has some local privilege can exploit the flaw to elevate to higher privilege levels. Organisations that allow local administrators or provide unmanaged user accounts should assess the risk of this vulnerability, prioritize patching, and consider tightening local privilege boundaries until a patch is applied.