The vulnerability in the Windows Overlay Filter is an out‑of‑bounds read that can be triggered by an authorized local user. When executed, it allows the attacker to gain higher privileges on the affected computer, effectively bypassing the local security boundaries. The flaw is a classic memory safety error that elevates the user’s authority within the operating system, granting access to system files, configuration settings, and potentially other users’ data.

Affected releases include Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025, in both Server Core and full installations, across x86, x64 and ARM64 architectures where applicable.

The CVSS base score of 7.8 indicates a high‑severity local privilege‑escalation vulnerability. EPSS is not public, so the current exploitation likelihood is unknown, but the absence from the CISA KEV catalog suggests it has not yet been widely observed in the wild. An attacker with local access and normal user privileges can leverage the out‑of‑bounds read to elevate to administrative rights on the target machine, compromising confidentiality, integrity and availability of the local system. Mitigation requires applying the specified vendor update.