--- id: "CVE-2026-121670" page: "https://infrastack.ai/live/CVE-2026-121670" kind: "vulnerability" aliases: ["CVE-2026-121670"] title: "Windows Overlay Filter race condition lets a local user gain higher privileges (fixed in November 2026 updates)" severity: "high" cvss: 7.0 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "windows-10-1607-server-2016", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "microsoft"}, {"name": "windows-10-1809-server-2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "microsoft"}, {"name": "windows-10-21h2", "fixed": ["10.0.19044.7846"], "affected": ">= 10.0.19044.0, < 10.0.19044.7846", "ecosystem": "microsoft"}, {"name": "windows-10-22h2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "microsoft"}, {"name": "windows-server-2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "microsoft"}, {"name": "windows-11-23h2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "microsoft"}, {"name": "windows-11-24h2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "microsoft"}, {"name": "windows-11-25h2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "microsoft"}, {"name": "windows-11-26h2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "microsoft"}, {"name": "windows-11-26h1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "microsoft"}, {"name": "windows-server-2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "microsoft"}] ecosystems: [] tags: ["infrastructure", "local-privilege-escalation", "windows", "windows-server", "wof"] not_affected_if: ["patched-build"] published_at: "2026-11-10T19:20:30+00:00" first_seen_at: "2026-11-10T19:25:09+00:00" updated_at: "2026-11-10T21:45:57+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121670", "first_seen_at": "2026-11-10T19:25:09+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-121670", "first_seen_at": "2026-11-10T21:45:57+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-121670", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-121670"]}] exploit_sources: [] --- # Windows Overlay Filter race condition lets a local user gain higher privileges (fixed in November 2026 updates) Link for people: https://infrastack.ai/live/CVE-2026-121670 (this .md is for agents) A race condition in the Windows Overlay Filter driver lets an authorized local user win a timing conflict over a shared resource. A successful attack lets that user elevate their privileges on the machine. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - microsoft:windows-10-1607-server-2016 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688 - microsoft:windows-10-1809-server-2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487 - microsoft:windows-10-21h2 affected >= 10.0.19044.0, < 10.0.19044.7846 fixed 10.0.19044.7846 - microsoft:windows-10-22h2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846 - microsoft:windows-server-2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870 - microsoft:windows-11-23h2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711 - microsoft:windows-11-24h2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974 - microsoft:windows-11-25h2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974 - microsoft:windows-11-26h2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974 - microsoft:windows-11-26h1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501 - microsoft:windows-server-2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822 ## How to check Run winver or PowerShell [System.Environment]::OSVersion.Version (or (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR for the revision) and compare the full build with the fixed builds: 10.0.14393.9688 (Win10 1607/Server 2016), 10.0.17763.9487 (1809/Server 2019), 10.0.19044.7846 (21H2), 10.0.19045.7846 (22H2), 10.0.20348.5870 (Server 2022), 10.0.22631.7711 (Win11 23H2), 10.0.26100.9974 (Win11 24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), 10.0.26100.33822 (Server 2025). Anything lower is affected. The KB number is on the MSRC page, which did not render for me. ## Fix Install the November 2026 Windows cumulative update that brings the OS build to at least the fixed build for your version (listed in how-to-check). Microsoft's KB article numbers were not readable; look them up in the MSRC Security Update Guide for CVE-2026-121670. ## Timeline - 2026-11-10T19:25:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121670 - 2026-11-10T21:45:57+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-121670 — Affected/fixed builds read from Microsoft's own CVE record (CNA, cveawg API). MSRC page is JS-only and did not render, so KB numbers unknown. Not exploited, no PoC (E:U). CVSS 7.0 AV:L/AC:H/PR:L per Microsoft. ## Documents - [advisory] CVE-2026-121670 CVE record published by Microsoft (CNA) https://cveawg.mitre.org/api/cve/CVE-2026-121670 - [fix] MSRC Security Update Guide: CVE-2026-121670 (page is JavaScript-only, did not render) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-121670 ## From the sources Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_