CVE-2026-50435: Windows Overlay Filter Privilege Escalation

CVE-2026-50435 Overview

CVE-2026-50435 is a buffer over-read vulnerability in the Windows Overlay Filter (WOF) driver. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. The weakness is classified under [CWE-126] (Buffer Over-read), where the software reads memory beyond the intended buffer boundary.

Microsoft published the advisory on July 14, 2026, and updated it on July 15, 2026. The vulnerability requires local access and low privileges, with no user interaction needed. Successful exploitation compromises confidentiality, integrity, and availability of the host.

Critical Impact
A local authenticated attacker can leverage the over-read in the Windows Overlay Filter to escalate privileges and gain full control of the affected system.

Affected Products

Microsoft Windows (Windows Overlay Filter component)
Specific Windows versions listed in the Microsoft Security Response Center advisory
Systems where the wof.sys driver is loaded and active

Discovery Timeline

2026-07-14 - CVE-2026-50435 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-50435

Vulnerability Analysis

The Windows Overlay Filter (WOF) is a file system filter driver that provides transparent file compression and virtualization. WOF sits between user-mode I/O requests and the underlying NTFS volume. The driver processes reparse points and compressed data streams on behalf of the operating system.

CVE-2026-50435 stems from an out-of-bounds read within WOF request handling. The driver reads past the end of an allocated buffer when parsing attacker-influenced structures. Because the driver operates in kernel context, the leaked memory can include sensitive kernel pointers, tokens, or object references. An attacker who controls the request layout can weaponize this disclosure to defeat kernel address space layout randomization (KASLR) and stage a privilege escalation primitive.

Root Cause

The root cause is missing or insufficient bounds validation on a length field or offset used during read operations inside the WOF driver. When the driver dereferences the affected structure, it consumes bytes beyond the intended allocation. This maps to [CWE-126] Buffer Over-read.

Attack Vector

Exploitation requires local access with a valid low-privilege user account. The attacker issues crafted requests to a WOF-managed file or IOCTL that reaches the vulnerable parsing path. No user interaction is needed. The scope is unchanged, meaning the impact is contained within the vulnerable component context, but that context is the Windows kernel.

No verified public proof-of-concept code is available. Refer to the Microsoft Security Update CVE-2026-50435 advisory for technical details.

Detection Methods for CVE-2026-50435

Indicators of Compromise

Unexpected loading or reloading of the wof.sys kernel driver by non-administrative processes
New local administrator accounts or SYSTEM-level process spawns following execution of an unsigned or unknown binary
Kernel crash dumps referencing the Windows Overlay Filter with access violation codes

Detection Strategies

Monitor for local processes issuing unusual DeviceIoControl calls or reparse-point operations against WOF-managed files
Alert on privilege-escalation chains where a standard user process is followed by a SYSTEM-integrity child process
Correlate WOF-related Windows Error Reporting (WER) events with subsequent authentication or token manipulation events

Monitoring Recommendations

Ingest Windows kernel event logs and driver telemetry into a centralized data lake for retrospective hunting
Track file system minifilter attachments and detachments to identify tampering with WOF
Baseline normal WOF activity per host so anomalous read patterns and driver interactions surface quickly

How to Mitigate CVE-2026-50435

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-50435 as soon as it is available for your Windows build
Restrict local logon rights and remove unnecessary interactive users from affected endpoints and servers
Enforce application control policies to prevent unauthorized binaries from executing kernel-facing operations

Patch Information

Microsoft has released guidance and updates through the Security Update Guide. Administrators should consult the Microsoft Security Update CVE-2026-50435 entry to identify the applicable Knowledge Base (KB) article for each affected Windows version and deploy it through Windows Update, WSUS, or Microsoft Endpoint Configuration Manager.

Workarounds

No official vendor workaround is documented; prioritize patch deployment
Reduce exposure by limiting local access and enforcing least privilege on Windows hosts
Enable attack surface reduction (ASR) rules and credential protections to slow post-exploitation activity

bash

# Verify installed updates on a Windows host
wmic qfe list brief /format:table

# Or using PowerShell to filter recent updates
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20