Microsoft Windows Overlay Filter: Elevation of privilege via buffer over-read
Summary
A buffer over-read in the Windows Overlay Filter component allows an attacker who already has a local, low-privileged account to elevate privileges to a higher level. The attack is local only and requires no user interaction, according to the CVSS vector. The main risk is as a second step after an attacker has already run code as a normal user, for example through phishing or a malicious attachment.
Affected
- Windows 10 Version 1607: builds 10.0.14393.0 to below 10.0.14393.9612
- Windows Server 2016: builds 10.0.14393.0 to below 10.0.14393.9612
- Further affected products listed by the CNA include Windows 10 1809, 21H2, 22H2, Windows 11 23H2 to 26H2, and Windows Server 2012 to 2025 (see the MSRC page for exact builds)
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
- Microsoft released fixes on 13 October 2026. KB numbers: Unknown. Check the MSRC page.
Workaround
Unknown. No vendor-documented workaround was found. Installing the patch is the fix.
Exploitation
- Not listed as known exploited (CISA KEV: No, per OpenCVE)
- EPSS below 1 percent (very low)
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- No public proof of concept found in our searches; this does not prove none exists
- No reports of in-the-wild exploitation found
Our recommendation
- Inventory systems by build number, especially Windows 10 1607 and Server 2016, and treat them as high priority if present
- Deploy the October 2026 cumulative update to affected hosts and confirm the KB and build on the MSRC page
- Where 1607 or Server 2016 cannot be patched or are out of support, plan replacement and restrict local logons and low-privileged code paths in the meantime
- Monitor for a public proof of concept or addition to the KEV catalog
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Windows Overlay Filter
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-69953 msrc.microsoft.com
- CVE record mirror (CNA JSON) via Vulners vulners.com
- Microsoft MSCVE record via Vulners vulners.com
- OpenCVE record (KEV and EPSS status) app.opencve.io
- Positive Technologies advisory PT-2026-112120 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:38.
Original description (NVD)
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.