CVE-2026-54987

What it actually does

This vulnerability is a local privilege escalation flaw caused by a heap-based buffer overflow in the Windows Overlay Filter component, commonly associated with the WOF kernel driver. An attacker who already has valid local access with low privileges can trigger memory corruption in kernel context and potentially execute code with SYSTEM-level privileges. Successful exploitation can provide full control over the affected Windows host, including the ability to disable security controls, access protected data, install persistent services or drivers, and manipulate system configuration. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited, this flaw can turn a limited foothold on a Windows workstation or server into full administrative control of that system. That can materially increase the impact of phishing, credential theft, malware execution, or insider misuse because an attacker can bypass normal user restrictions after initial access. Affected platforms include widely deployed Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, so enterprise exposure may be broad. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity in the provided data, which suggests no confirmed widespread exploitation at this time; however, local privilege escalation bugs are frequently chained with remote access, malware, and ransomware activity once exploit code becomes available.

How an attack unfolds

An attacker first needs local code execution or an interactive/logon-capable account on an affected Windows system. This access may come from phishing, malware, stolen credentials, exploitation of a separate remote vulnerability, or abuse of exposed remote administration services. Once on the host, the attacker runs a crafted program that interacts with the Windows Overlay Filter in a way that triggers the heap-based buffer overflow. If the memory corruption is successfully controlled, the attacker can redirect kernel execution or corrupt security-sensitive kernel structures to elevate privileges. After obtaining SYSTEM-level execution, the attacker typically performs post-exploitation actions such as dumping credentials, disabling endpoint protection, creating persistence, moving laterally, or staging additional payloads. Because the flaw is local and requires prior authorization, detection should focus on suspicious privilege transitions, unexpected child processes running as SYSTEM, abnormal driver/component interaction, and post-exploitation behavior rather than only network indicators.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows 10, Windows 11, and Windows Server releases. Because exact fixed build numbers were not provided, use the latest cumulative security update available for each supported affected platform and verify that systems are on a Microsoft-supported servicing channel. Prioritize servers, shared workstations, jump hosts, developer workstations, and systems where low-privileged users can log on interactively or run code. If immediate patching is not possible, reduce risk by restricting local logon rights, limiting remote desktop and remote management access, enforcing application control, blocking untrusted executable content, hardening endpoint detection and response tamper protection, and minimizing local administrator group membership. There is no reliable configuration-only mitigation for a kernel heap overflow; patching is the primary remediation.

How to confirm the fix worked

Confirm that each affected Windows asset has installed the relevant Microsoft cumulative security update released for this issue or a later update. Validate through centralized patch management, Windows Update history, Microsoft Update Compliance, WSUS, Configuration Manager, or endpoint inventory tooling. Check the OS build and update level against Microsoft’s security update guidance for the affected Windows version. Where practical, verify the Windows Overlay Filter driver file version after patching and ensure it matches the expected version from the installed cumulative update. Confirm that unsupported or end-of-servicing Windows versions are upgraded or otherwise isolated. Exposure validation should include identifying Windows 10, Windows 11, and Windows Server 2012/2016/2019/2022/2025 systems that allow local user code execution and have not received the relevant July 2026-or-later security update.

Typical attack path

1. Gain initial local access to an affected Windows workstation or server using credentials, malware, phishing, or another vulnerability.
2. Transfer or stage a purpose-built local exploit binary on the host.
3. Execute the exploit from a low-privileged user context to trigger the Windows Overlay Filter heap overflow.
4. Achieve code execution or token manipulation in kernel context and obtain SYSTEM-level privileges.
5. Disable or tamper with security tooling, logging, or recovery controls.
6. Dump credentials, access sensitive files, install persistence, or move laterally to other systems.

How to detect it

There are no provided public exploit indicators, no KEV listing, and no known threat actor attribution in the input, so detection should be behavior-based. Review endpoint telemetry, EDR alerts, Windows Security logs, Sysmon logs, PowerShell logs, service-control events, and driver/module telemetry for signs of local privilege escalation followed by SYSTEM-level activity. Look for low-privileged user processes that unexpectedly create SYSTEM child processes, spawn command shells as SYSTEM, install services, create scheduled tasks, modify local administrator membership, dump LSASS memory, disable security tools, or write executables to user-writable locations before privilege changes. Relevant Windows events may include process creation events, service installation events, scheduled task creation, special privilege assignment, logon events showing privilege changes, audit policy changes, and security product tampering. Compare timestamps around suspicious local logons, executable launches from temporary or profile directories, crashes or instability involving the Windows Overlay Filter driver, and immediate post-exploitation actions such as credential dumping or lateral movement. Kernel memory corruption exploits may not leave a unique application log entry, so absence of a crash does not rule out exploitation.

What your security team should do

• Inventory all affected Windows workstation and server versions and identify systems missing the applicable Microsoft cumulative security update.
• Prioritize patching of internet-adjacent management hosts, servers with multiple local users, remote desktop hosts, jump boxes, build systems, and endpoints used by privileged administrators.
• Hunt for suspicious local privilege escalation behavior, especially low-privileged processes spawning SYSTEM shells, service creation shortly after user logon, unexpected driver activity, or endpoint protection tampering.
• Restrict local and remote interactive logon rights to only required users and groups until patch coverage is complete.
• Enforce application control or allowlisting to prevent execution of unapproved local exploit binaries from user-writable paths.
• Review local administrator group membership, scheduled tasks, services, and startup locations for unauthorized persistence.
• Ensure EDR, antivirus, Windows Defender tamper protection, and security event logging are enabled and centrally collected.
• Monitor public exploit availability and vendor advisories; increase urgency if proof-of-concept code, active exploitation, KEV listing, or ransomware usage emerges.