An integer overflow or wraparound vulnerability exists in the Windows Overlay Filter component, allowing an attacker who already has local system access to trigger the flaw. By supplying crafted data, the overflow can cause the driver to execute code with elevated privileges, providing the attacker local privilege escalation. The issue originates from a signed integer overflow (CWE‑126) that leads to arithmetic wraparound (CWE‑190).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012 (full and core), Server 2012 R2 (full and core), Server 2016, Server 2019, Server 2022, and Server 2025 (including core installations).

The overall risk for affected systems is high when local users can load or influence the Overlay Filter. Attackers must have local access to supply crafted data that triggers the integer overflow; the flaw provides a direct path to elevating privileges without remote code execution. Because the attack is local, external perimeter defenses do not mitigate it, so internal controls such as least privilege and application whitelisting remain critical. The CVSS score of 7.8 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests that exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog, but the potential impact warrants immediate attention.