A buffer over-read exists in the Windows Overlay Filter that allows an attacker with legitimate user rights to read memory beyond intended bounds. The flaw can be leveraged to gain elevated privileges on the host, giving the attacker full control over the affected system. This vulnerability represents a classic use of CWE‑126 and directly compromises the integrity of the operating environment by enabling malicious code execution and privilege escalation.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), 26H1 (x64); Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations). The affected platforms span 32‑bit and 64‑bit architectures, including ARM‑based builds of Windows 11.

The CVSS score of 7.8 indicates a high severity for local privilege escalation. EPSS data is currently unavailable, but the lack of a KEV listing does not diminish the risk to environments that have not yet applied mitigations. The attack requires an authorized user context and local access. An unauthenticated attacker would need physical or remote access to the target machine to exploit the flaw. The vulnerability is not yet widely exploited in the wild according to available public sources.