The Windows Overlay Filter Tampering Vulnerability is a missing authorization flaw (CWE-862) in Microsoft Windows that allows an authorized user to tamper with the overlay filter functionality. The lack of proper access checks can enable local manipulation of graphical overlays, potentially compromising the integrity of display outputs or user interfaces. Because it is a missing authorization issue rather than a buffer overflow or code execution flaw, the direct impact is limited to local changes in the overlay filter state.

Affected systems include Microsoft Windows 10 builds 1607, 1809, 21H2, and 22H2, as well as Microsoft Windows 11 builds 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2016, 2019, 2022, and 2025 (both full and core editions). All listed editions are susceptible to local tampering of the overlay filter.

The CVSS score of 5.5 indicates moderate risk; however, exploitability is limited to a local attacker with authenticated user rights, and no remote vectors exist. EPSS is not available and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting low current exploitation activity. Nonetheless, the missing authorization flaw permits local users to alter overlay behavior, warranting prompt mitigation.