CVE-2026-42837: Windows Projected File System Elevation of Privilege Vulnerability

Synopsis

A buffer over-read in the Windows Projected File System (ProjFS) Filter Driver allows a locally authenticated attacker to escalate their privileges on the affected host. The vulnerability is reached locally, meaning the attacker must already have an existing session or process on the machine, and requires only a low-privilege account to trigger. Successful exploitation gives the attacker full control over the system, covering confidentiality, integrity, and availability. Patched-image rebuilds at the fixed Windows build versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to reach the vulnerable driver.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed before exploitation.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker triggers the vulnerability entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or environmental dependencies required to succeed.

Blast Radius

• A successful attacker gains SYSTEM-level or equivalent kernel privileges, taking full control of the host.
• The attacker can read any file, credential, or secret accessible on the machine, including those belonging to other users and services.
• The attacker can modify or delete any data on the host, including system files, application state, and persisted records.
• The attacker can crash, halt, or destabilize the operating system or any service running on it.