CVE-2026-54987: Windows 10 Privilege Escalation Flaw

CVE-2026-54987 Overview

CVE-2026-54987 is a heap-based buffer overflow vulnerability in the Windows Overlay Filter (WOF) driver. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server systems. The issue is tracked as CWE-122: Heap-based Buffer Overflow and affects the Windows Overlay Filter kernel component that handles file system overlays and compression.

Microsoft published the advisory on 2026-07-14. The vulnerability requires local access and low privileges, but successful exploitation yields high impact on confidentiality, integrity, and availability. No public proof-of-concept or in-the-wild exploitation has been reported at time of publication.

Critical Impact
A local authenticated attacker can corrupt kernel heap memory through Windows Overlay Filter and escalate to SYSTEM privileges across supported Windows 10, Windows 11, and Windows Server releases.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (versions 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - Microsoft publishes security advisory for CVE-2026-54987
2026-07-14 - CVE-2026-54987 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-54987

Vulnerability Analysis

The vulnerability resides in the Windows Overlay Filter (wof.sys), a kernel-mode file system filter driver that provides transparent file compression and virtualization of file data. WOF is used by Windows features including Compact OS and container image overlays. The driver processes reparse point data and compressed stream metadata supplied through file system I/O operations.

A heap-based buffer overflow occurs when the driver allocates a pool buffer based on one size value but writes attacker-influenced data using a different, larger length. Because WOF operates in kernel mode, the corrupted allocation lives in the non-paged pool. Overwriting adjacent pool structures allows an attacker to manipulate kernel object fields and hijack execution flow.

Root Cause

The root cause is improper validation of length fields in WOF-managed metadata before copying data into a heap allocation. The mismatch between allocation size and copy length produces the out-of-bounds write classified as [CWE-122]. Kernel pool grooming techniques let an attacker place a controlled target object adjacent to the vulnerable allocation.

Attack Vector

Exploitation is local and requires an authenticated user session on the target host. An attacker triggers the vulnerable code path by issuing crafted file system requests, such as opening files with malformed reparse points or interacting with WOF-compressed streams. No user interaction is required beyond the attacker's own process. Successful exploitation typically results in arbitrary kernel read/write and a token replacement primitive that yields SYSTEM.

No verified proof-of-concept code is publicly available. See the Microsoft Security Update CVE-2026-54987 advisory for vendor technical details.

Detection Methods for CVE-2026-54987

Indicators of Compromise

Unexpected loading or interaction with wof.sys by non-system user processes
Kernel bugcheck events referencing POOL_CORRUPTION_IN_FILE_AREA or DRIVER_OVERRAN_STACK_BUFFER shortly after user-mode file operations
New processes spawned as NT AUTHORITY\SYSTEM from a parent running under a standard user token
Creation of files or reparse points with anomalous WOF compression headers in user-writable directories

Detection Strategies

Monitor kernel crash dumps for pool corruption signatures involving the WOF driver and correlate with recent user activity
Alert on token manipulation patterns where a child process runs with a higher integrity level than its parent
Track anomalous DeviceIoControl and NtFsControlFile calls targeting WOF reparse tags from unprivileged processes

Monitoring Recommendations

Enable Windows Defender Application Control and Attack Surface Reduction rules that block credential and token theft behaviors
Forward Sysmon Event IDs 1, 10, and 25 to a central data lake for correlation of process creation, process access, and process tampering events
Baseline legitimate WOF usage on servers and endpoints to identify deviations that may indicate exploitation attempts

How to Mitigate CVE-2026-54987

Immediate Actions Required

Apply the July 2026 Microsoft security updates referenced in the MSRC advisory for CVE-2026-54987 to all affected Windows client and server systems
Prioritize patching multi-user systems, terminal servers, and virtual desktop infrastructure where local users are common
Audit local account membership and remove unnecessary interactive logon rights on servers

Patch Information

Microsoft has released cumulative updates addressing CVE-2026-54987 for all supported Windows 10, Windows 11, and Windows Server versions listed in the advisory. Administrators should deploy the corresponding monthly rollup or standalone security update through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog. Refer to the Microsoft Security Update CVE-2026-54987 page for KB numbers per operating system version.

Workarounds

No official workaround has been published by Microsoft; patching is the required remediation
Restrict local logon rights and enforce least privilege on endpoints to reduce the population of accounts able to trigger the flaw
Enable kernel-mode exploit mitigations such as Hypervisor-protected Code Integrity (HVCI) and Virtualization-based Security (VBS) to raise the cost of kernel exploitation

bash

# Verify installed update on Windows using PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm HVCI and VBS status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunning