Microsoft Windows: Elevation of privilege via race condition in Overlay Filter

Summary

A race condition (CWE-362) in the Windows Overlay Filter allows a locally authorized user to gain higher privileges on the affected system. Exploitation requires local access, high attack complexity and low privileges, and no user interaction. The flaw is not remotely exploitable, so it matters mainly after an attacker has already gained a foothold, for example through phishing, malware or a shared terminal server.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)
• Windows Server 2025: affected build range unconfirmed, sources disagree

Fixed in

• Install the latest Microsoft security update for each affected Windows version (October 2026 or later).
• Expected fixed builds: 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
• Windows Server 2025: fixed build unconfirmed (sources list 10.0.26100.33650 or 10.0.26100.33822). Verify on MSRC.
• The fixed builds are taken from the CVE record and secondary sources; verify them on MSRC before relying on them.

Workaround

Unknown. No vendor-documented workaround was found. Patching is the only confirmed fix.

Exploitation

• No known exploitation in the wild.
• No public proof of concept found in a limited search.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• EPSS score is low (0.00207 for the related CVE-2026-83879).
• The CVSS vector rates exploit maturity as unproven.

Our recommendation

• Patch all Windows hosts to the latest cumulative update, starting with multi-user systems, terminal and RDS servers, and servers.
• Check for Windows 10 1607, 1809 and 21H2 and for Windows Server 2016 and 2019. Verify whether extended security updates are available and required for these versions.
• Limit local accounts and administrator rights, and monitor for unusual privilege changes.
• Re-check the exact fixed builds on MSRC once the advisory has been reviewed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-121670 msrc.microsoft.com
• CVE.org record CVE-2026-121670 www.cve.org
• Strix: CVE-2026-121670 www.strix.ai
• SonicWall: Microsoft security bulletin coverage for October 2026 www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:23.