What is the CVSS score of CVE-2026-42828?

CVE-2026-42828 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows ProjFS are affected by CVE-2026-42828?

CVE-2026-42828 affects the Windows Projected File System (ProjFS) Filter Driver, enabling local users with low-level privileges to escalate to administrative access.. A patch is available.

How to fix or mitigate CVE-2026-42828?

Within 24 hours: Identify all Windows systems with ProjFS filter driver enabled; enable detailed audit logging for privilege escalation attempts and process creation events. Within 7 days: Implement or enforce privileged access management (PAM) controls restricting local interactive login to authorized administrators; disable ProjFS on systems where operationally feasible; deploy or configure EDR solutions with local privilege escalation detection rules. Within 30 days: Monitor Microsoft Security Updates and CISA advisories for patch availability; upon vendor patch release, prioritize deployment to critical systems within 48 hours and remaining systems within 7 days.

Windows ProjFS CVE-2026-42828

EUVD-2026-35533 HIGH

Buffer Over-read (CWE-126)

2026-06-09 secure@microsoft.com

GHSA-f9fc-826q-m9w2

Buffer Overflow Microsoft Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:36 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Projected File System (ProjFS) Filter Driver enables an authorized low-privileged user to elevate to higher privileges through a buffer over-read condition. The flaw affects Microsoft Windows installations where the ProjFS filter driver is present, and exploitation yields high impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The Projected File System (ProjFS) is a Windows kernel-mode filter driver (prjflt.sys) that enables user-mode providers to project virtual files and directories into the file system namespace - notably used by Microsoft VFS for Git and similar virtualization providers. The underlying weakness is CWE-126 (Buffer Over-read), where the driver reads past the end of an allocated buffer, typically due to insufficient bounds checking on attacker-influenced size or offset fields supplied through IOCTLs or projection callbacks. Because ProjFS runs in kernel context, an over-read can leak kernel memory contents (potentially KASLR-defeating pointers or sensitive data) or be chained with adjacent flaws to corrupt state and pivot to elevation of privilege.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42828 via the monthly Patch Tuesday cumulative update for the affected Windows release - patch available per vendor advisory, with exact fix build numbers documented in that advisory. As a compensating control on systems that cannot be patched immediately, disable the 'Windows Projected File System' optional feature (Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS) where it is not required, accepting the trade-off that any applications relying on ProjFS - most notably VFS for Git / Scalar virtualization - will stop functioning. On endpoints where ProjFS must remain enabled, restrict interactive and remote-desktop logon to trusted accounts only and increase EDR sensitivity on prjflt.sys driver interactions, recognizing that this only reduces the population of potential attackers rather than removing the vulnerability.