{"id":"CVE-2026-112760","kind":"vulnerability","aliases":["CVE-2026-112760"],"related":[],"title":"Windows Overlay Filter: integer overflow lets a local user gain higher privileges","description":"Integer overflow or wraparound in Windows Overlay Filter allows an unauthorized attacker to elevate privileges locally.","summary":"A flaw in the Windows Overlay Filter component is an integer overflow or wraparound that lets an unauthorized local user elevate privileges. An attacker who already has a foothold on the machine could gain higher rights, such as SYSTEM or administrator.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:38+00:00","first_seen_at":"2026-11-10T19:24:32+00:00","triaged_at":"2026-11-10T19:42:15+00:00","updated_at":"2026-11-10T19:42:15+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:42:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Overlay Filter: integer overflow lets a local user gain higher privileges","impact":"high","summary":"A flaw in the Windows Overlay Filter component is an integer overflow or wraparound that lets an unauthorized local user elevate privileges. An attacker who already has a foothold on the machine could gain higher rights, such as SYSTEM or administrator.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the Windows machine","analyst_note":"Check the Microsoft Security Update Guide entry for affected Windows builds, the patch, and any mitigation; the NVD record alone gives no version or fix data.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Only a local attacker with some foothold on a Windows machine can use this, since the flaw is local privilege escalation rather than remote code execution. The sources do not list affected Windows builds or whether the Overlay Filter is enabled by default. Remote-only attack paths are not described.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4500,"output_tokens":466,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for affected Windows builds, the patch, and any mitigation; the NVD record alone gives no version or fix data.","search":"'-112760':15A,18A '-2026':14A,17A 'administr':61B 'allow':70C 'alreadi':46B 'attack':44B,73C 'compon':28B 'could':53B 'cve':13A,16A 'elev':41B,75C 'filter':3A,27B,69C 'flaw':22B 'foothold':49B 'gain':10A,54B 'higher':11A,55B 'infrastructur':19B 'integ':4A,31B,62C 'let':6A,36B 'local':8A,39B,77C 'machin':52B 'overflow':5A,32B,63C 'overlay':2A,26B,68C 'privileg':12A,42B,76C 'right':56B 'system':59B 'unauthor':38B,72C 'user':9A,40B 'window':1A,20B,25B,67C 'wraparound':34B,65C","nicknames":[],"mitigations":[],"who_affected":"Only a local attacker with some foothold on a Windows machine can use this, since the flaw is local privilege escalation rather than remote code execution. The sources do not list affected Windows builds or whether the Overlay Filter is enabled by default. Remote-only attack paths are not described.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-112760':15A,18A '-2026':14A,17A 'cve':13A,16A 'filter':3A 'gain':10A 'higher':11A 'integ':4A 'let':6A 'local':8A 'overflow':5A 'overlay':2A 'privileg':12A 'user':9A 'window':1A","search_b":"'administr':61B 'alreadi':46B 'attack':44B 'compon':28B 'could':53B 'elev':41B 'filter':27B 'flaw':22B 'foothold':49B 'gain':54B 'higher':55B 'infrastructur':19B 'integ':31B 'let':36B 'local':39B 'machin':52B 'overflow':32B 'overlay':26B 'privileg':42B 'right':56B 'system':59B 'unauthor':38B 'user':40B 'window':20B,25B 'wraparound':34B","search_c":"'allow':70C 'attack':73C 'elev':75C 'filter':69C 'integ':62C 'local':77C 'overflow':63C 'overlay':68C 'privileg':76C 'unauthor':72C 'window':67C 'wraparound':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112760","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112760","severity":null,"published_at":"2026-11-10T19:18:38+00:00","modified_at":"2026-11-10T19:18:39+00:00","first_seen_at":"2026-11-10T19:24:32+00:00","fetched_at":"2026-11-10T19:24:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}