Buffer over-read within the Windows Overlay Filter enables a locally authorized user to exploit the flaw to elevate privileges. The vulnerability stems from improper bounds checking (CWE-126) and can lead to unrestricted local privilege escalation, affecting the confidentiality, integrity, and availability of the system within the user’s context.

Affected Microsoft Windows releases include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 variants 23H2, 24H2, 25H2, 26H2, 23H2 again, and 26H1; as well as Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025. The flaw has been identified on x86, x64, and arm64 architectures as indicated by the listed CPUs. All products listed in the known CNA vendors/products list are considered vulnerable.

With a CVSS score of 7.8, this issue is classified as high severity. No EPSS data is available, and the vulnerability is not currently included in the CISA KEV catalog, suggesting limited known exploitation activity. Attack vector is inferred to be local, as the flaw requires an authorized user to submit a crafted overlay image. Given the severity, prompt patching is advised to mitigate the risk of privilege escalation.