Windows: Out-of-bounds read in Windows Overlay Filter allows local privilege escalation

Summary

A out-of-bounds read (CWE-125) in the Windows Overlay Filter component allows an authenticated local user to elevate privileges. CVSS 3.1 rates it 7.8 (High) with local attack vector, low privileges required and no user interaction. The main risk is multi-user systems such as terminal servers or hosts where untrusted users or services run code. The CNA record and CISA SSVC data show no known exploitation and no public exploit.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612
• Windows 10 Version 1809: build 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: build 10.0.19045.7807 (per the CNA range; verify against MSRC)
• Windows 11 Version 23H2: build 10.0.22631.7652
• Windows 11 Version 24H2: build 10.0.26100.9711
• Windows 11 Version 25H2 and 26H2: build 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: build 10.0.28000.3231
• Windows Server 2012: build 6.2.9200.26434
• Windows Server 2012 R2: build 6.3.9600.23470

The KB numbers were not confirmed in the sources.

Workaround

Unknown. No workaround is documented. Applying the security update is the remedy.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept or exploit found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS 0.00318 at the time of the snapshot.
• Microsoft's own exploitability assessment could not be verified.

Our recommendation

• Inventory all Windows hosts and identify Windows 10 1607 and Server 2016 systems first.
• Install the October 2026 security update for each affected build; obtain the KB numbers from the MSRC page.
• Replace Windows 10 1607 and other out-of-support systems if no extended support is available.
• Restrict interactive and RDP logon to trusted users and review which accounts can run code on shared hosts.
• Monitor for unusual local privilege changes and new services on multi-user systems.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105004 msrc.microsoft.com
• Vulners NVD record CVE-2026-105004 vulners.com
• VulDB entry 418065 vuldb.com
• CVE record mirror (threatint) cve.threatint.com
• Strix CVE-2026-105004 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:03.