Microsoft Windows: Local privilege escalation via buffer over-read in Overlay Filter

Summary

A buffer over-read in the Windows Overlay Filter in several Windows 10, Windows 11 and Windows Server versions allows an authorized attacker to elevate privileges locally (CVSS 7.8, High, CWE-126). The attacker needs a low-privileged local account and no user interaction, so the flaw is not directly exploitable from the internet. A successful attack could affect confidentiality, integrity and availability of the affected host, and is most relevant on multi-user servers and terminal servers.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: before 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 Version 23H2: before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, Windows 11 Version 26H2: before 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: before 10.0.28000.3231
• Windows Server 2012 (including Server Core): before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): before 6.3.9600.23470

Fixed in

• Install the October 2026 cumulative update (or the later update) for each affected build.
• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9612 or later. The KB number is unknown and must be taken from the MSRC advisory.
• Other builds: see the minimum builds listed under affected.

Workaround

Unknown. No vendor workaround is documented; the security update is the remedy.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog.
• EPSS about 0.3%.
• No public proof of concept found in our research; this does not prove that none exists.
• VulDB estimates an exploit price of USD 5k to 25k. VulDB describes the flaw as a buffer overflow (CWE-120/119), which differs from the Microsoft/NVD classification.

Our recommendation

• Patch all affected systems with the October 2026 update or later, starting with multi-user servers, RDS/terminal servers and Windows 10 1607 / Server 2016 hosts.
• Verify that 1607 and Server 2016 hosts actually received the update, and confirm that these builds are still supported before relying on patches.
• Restrict local interactive logon on servers and shared hosts, apply least privilege and keep EDR active to detect privilege escalation.
• Priority: high for multi-user and older systems, medium for single-user workstations.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83727 msrc.microsoft.com
• NVD record via Vulners vulners.com
• Microsoft CNA record via Vulners vulners.com
• OpenCVE: CVE-2026-83727 app.opencve.io
• VulDB: CVE-2026-83727 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:12.