Microsoft Windows 10 1607: Out-of-bounds read in Windows Overlay Filter
Summary
An out-of-bounds read in the Windows Overlay Filter component affects Windows 10 Version 1607. The same build underlies Windows Server 2016, which is also listed as affected. An attacker with local access and a low-privilege account can exploit the flaw without user interaction, and the CVSS vector rates the impact on confidentiality, integrity and availability as high. The flaw is not directly reachable from the internet.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
- Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
- Other Windows 10, Windows 11 and Windows Server branches are listed by Microsoft as well.
Fixed in
- Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
- KB number for Windows 10 1607: Unknown. Check the MSRC page.
Workaround
Unknown. Microsoft has published no workaround; the update is the fix. A third-party aggregator suggests limiting local account privileges, but this is not a Microsoft recommendation.
Exploitation
- Publicly disclosed: No
- Exploited: No (per MSRC)
- Exploitability assessment: Exploitation Less Likely
- Exploit code maturity: Unproven
- No public proof of concept or in-the-wild use found at the time of research
Our recommendation
- Install the Microsoft update that brings Windows 10 1607 and Server 2016 to build 10.0.14393.9612 or later.
- Identify all Windows 10 1607 and Server 2016 systems and check their Extended Security Updates and support status, since these systems may be unsupported.
- Restrict local accounts to the minimum privileges needed and limit shared or multi-user systems.
- Monitor for unusual local activity on affected systems.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows Overlay Filter
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-69959 msrc.microsoft.com
- Vulners: CNA JSON (CVEList) for CVE-2026-69959 vulners.com
- Vulners: NVD record for CVE-2026-69959 vulners.com
- OpenCVE: CVE-2026-69959 app.opencve.io
- Strix: CVE-2026-69959 (cross-check) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:35.
Original description (NVD)
Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to execute code locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.