Microsoft Windows: Out-of-bounds read in Overlay Filter allows privilege escalation

Summary

A flaw in the Windows Overlay Filter component allows an out-of-bounds read (CWE-125) that can be used for local privilege escalation. An attacker needs a valid, low-privileged local user account and can then gain higher privileges with high impact on confidentiality, integrity and availability of the local system. The vulnerability is not reachable directly from the internet.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to < 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)

Fixed in

Install the Microsoft security update for the affected Windows release. Fixed builds according to the CNA record:

• Windows 10 1607 / Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807 (to be verified on the MSRC page)
• Windows 11 23H2: 10.0.22631.7652
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470

The KB numbers for each release are listed on the MSRC advisory.

Workaround

Unknown. The sources reviewed do not list a workaround. Check the MSRC advisory for interim mitigations.

Exploitation

• CISA SSVC assessment in the official record: exploitation none, not automatable, total technical impact.
• No public exploit or in-the-wild exploitation was found in the sources reviewed.
• The CISA KEV catalogue was not checked directly.
• Reported by Positive Technologies (advisory PT-2026-112119).

Our recommendation

• Install the October 2026 Microsoft security update on all affected systems, with priority on terminal servers and shared workstations.
• Remove or restrict local logon rights for accounts that do not need them.
• Replace Windows 10 1607 systems, which are end-of-life, or verify their support status with Microsoft.
• Install the other Overlay Filter fixes published the same day together with this update.
• Check the MSRC advisory for updated exploitability information and the CISA KEV catalogue for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69952 msrc.microsoft.com
• NVD: CVE-2026-69952 vulners.com
• CNA record (CVEList) vulners.com
• Microsoft MSCVE entry: CVE-2026-69952 vulners.com
• OpenCVE: CVE-2026-69952 app.opencve.io
• Positive Technologies advisory PT-2026-112119 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:38.