Microsoft Windows: Local privilege escalation in Overlay Filter

Summary

Several supported Windows 10, Windows 11 and Windows Server editions contain a buffer over-read in the Windows Overlay Filter component (CWE-126). An attacker with a valid local, low-privileged account can exploit it to gain elevated privileges, which can lead to full control of the affected system. The CVSS 3.1 base score is 7.8 (High). At the time of research, no exploitation in the wild and no public proof of concept were found.

Affected

• Windows 10 Version 1607 and Windows Server 2016: builds below 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: builds below 10.0.17763.9376
• Windows 10 Version 21H2: builds below 10.0.19044.7807
• Windows 10 Version 22H2: builds below 10.0.19045.7807
• Windows 11 Version 23H2: builds below 10.0.22631.7652
• Windows 11 Version 24H2: builds below 10.0.26100.9711
• Windows 11 Version 25H2: builds below 10.0.26200.9711
• Windows 11 Version 26H1: builds below 10.0.28000.3231
• Windows 11 Version 26H2: builds below 10.0.26300.9711
• Windows Server 2012 and 2012 R2: builds below 6.2.9200.26434 and 6.3.9600.23470 respectively

Fixed in

• Fixed builds are listed in the Microsoft Security Update Guide (CNA record). Verify the exact build on the MSRC page before rollout.
• Windows 10 1607 / Server 2016: 10.0.14393.9612 (one aggregator lists 10.0.14393.9596; not confirmed)
• Windows 10 1809 / Server 2019: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807; 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652; 24H2: 10.0.26100.9711; 25H2: 10.0.26200.9711; 26H1: 10.0.28000.3231
• Windows Server 2012 / 2012 R2: 6.2.9200.26434 / 6.3.9600.23470
• Servicing stack updates were released on the same day for Windows 10 1607 / Server 2016 (KB5126649) and Server 2012 / 2012 R2 (KB5127356, KB5127357). Check whether a cumulative update is also required.

Workaround

Unknown. No workaround was identified; Microsoft's description states none, but this could not be verified on the advisory page. Installing the security update is the fix.

Exploitation

• No evidence of exploitation in the wild was found. Check the CISA Known Exploited Vulnerabilities catalog directly.
• No public proof of concept was found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• EPSS was low (0.00341) in the aggregator snapshot.

Our recommendation

• Install the Microsoft security update for all affected Windows and Server versions as soon as possible, after confirming the exact fixed build on the MSRC page.
• Windows 10 1607 and Server 2012 are end-of-life or near it: check the lifecycle status and plan an upgrade if they are still in use.
• Prioritise shared PCs, terminal and RDS servers, and kiosk or industrial systems, where low-privileged users are more likely.
• Limit local accounts and reduce the risk of phishing and malware that could provide a foothold.
• Monitor for unusual privilege changes and new administrative accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-69950 msrc.microsoft.com
• Vulners NVD mirror: CVE-2026-69950 vulners.com
• Vulners CVE list (CNA data): CVE-2026-69950 vulners.com
• Vulners Microsoft CVE mirror: CVE-2026-69950 vulners.com
• OpenCVE: CVE-2026-69950 app.opencve.io
• Vulners Rapid7 record: Windows CVE-2026-69950 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:37.