A heap‑based buffer overflow exists in the Windows Overlay Filter that permits an attacker who can physically access a system to execute arbitrary code. The flaw is a classic buffer overflow (CWE‑122) that can overwrite stored data, potentially leading to privilege escalation or full system compromise if the attacker gains the ability to trigger the overflow through a malicious input file or user interaction with the overlay mechanism.

The vulnerability affects Microsoft Windows operating systems and Server editions from Windows 10 1607 onward, including Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both normal and server core installations.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known exploits in the wild. Attackers would need physical access to the target machine or the ability to introduce a malicious payload that triggers the overlay filter. Once exploited, the attacker could achieve code execution with the privileges of the process that loads the overlay, potentially compromising the entire system.