Microsoft Windows: Heap-based buffer overflow in Windows Overlay Filter

Summary

A heap-based buffer overflow in the Windows Overlay Filter component affects several supported Windows 10, Windows 11 and Windows Server versions, including Windows 10 21H2. According to the CVE description, an attacker with physical access to a device can execute code. The vector is physical, so there is no internet exposure, but the attack needs no privileges and no user interaction, so brief access to an unattended or stolen device is enough. The CVSS 3.1 base score is 6.8 (MEDIUM), and Microsoft rates the maximum severity as Important.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to below 10.0.26100.33650

Fixed in

• Windows 10 Version 21H2: build 10.0.19044.7807 or later
• Windows 10 Version 22H2: build 10.0.19045.7807 or later
• Windows 11 Version 23H2: build 10.0.22631.7652 or later
• Windows 11 Version 24H2 and 25H2: build 10.0.26100.9711 or later, and 10.0.26200.9711 or later
• Windows 11 Version 26H1: build 10.0.28000.3231 or later
• Windows 11 Version 26H2: build 10.0.26300.9711 or later
• Windows Server 2022: build 10.0.20348.5761 or later
• Windows Server 2025: build 10.0.26100.33650 or later
• The KB number for Windows 10 21H2 is unknown. Check the MSRC page or the Microsoft Update Catalog.

Workaround

No workaround is documented. The vendor's remedy is the security update.

Exploitation

• Not publicly disclosed and not known to be exploited (MSRC).
• Exploit code maturity is Unproven and exploitation is rated Less Likely (MSRC).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalogue according to OpenCVE. The CISA site was not checked directly.
• No public proof of concept found. EPSS is about 0.44%.

Our recommendation

• Install the latest Windows security update that addresses CVE-2026-69947 on all affected systems, prioritising laptops and shared PCs.
• Check whether any Windows 10 21H2 device is on Enterprise LTSC 2021 or enrolled in ESU. Home and Pro editions and Enterprise and Education editions no longer receive this fix. Upgrade these devices instead of only patching them.
• Reduce physical access risk: enable BitLocker, enable Secure Boot, set a UEFI/BIOS password, disable booting from USB, and lock unattended devices.
• Monitor the vendor advisory for updates to the exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-69947 msrc.microsoft.com
• NVD mirror on Vulners: CVE-2026-69947 vulners.com
• OpenCVE: CVE-2026-69947 app.opencve.io
• Microsoft Windows 10 21H2 end of servicing (Windows Central) www.windowscentral.com
• Windows 10 21H2 end of support (Neowin) www.neowin.net
• Windows 10 21H2 end of support and LTSC 2021 (Petri) petri.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 23:03.