CVE-2026-42828: Windows Projected File System Elevation of Privilege Vulnerability

Synopsis

Buffer over-read in the Windows Projected File System Filter Driver allows a local attacker with a low-privilege account to elevate privileges on affected Windows 10 and Windows 11 systems. The vulnerability is reached locally and requires no interaction from another user, but the attacker must already hold a valid user account on the machine. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative rights are needed to trigger the vulnerability.

• Victim interactionNot required

  No action from another user is required; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental dependencies required.

Blast Radius

• A successful attacker reads protected files, credentials, and secrets accessible on the host system.
• A successful attacker modifies system files, registry entries, or other persisted data on the host.
• A successful attacker can crash or disable the affected Windows system or its services.
• Because all three of confidentiality, integrity, and availability are rated High, full compromise of the host is achievable from a standard user context.