Windows ProjFS CVE-2026-42837

Attacker must already have local, interactive or remote-shell code execution on the target Windows host as an authenticated standard user (CVSS PR:L), and the Projected File System feature must be installed and the prjflt.sys filter driver loaded - which is the default on modern Windows client builds and on systems using Git VFS for Git, Scalar, or Dev Drive. No user interaction is required (UI:N) and attack complexity is low (AC:L). Exploitation is limited to the local machine (AV:L, scope unchanged), so it cannot be triggered directly over the network and provides no lateral movement on its own; hosts where ProjFS has been explicitly disabled or never installed are not exposed.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H paints a consistent local-EoP profile: an attacker must already have code execution as a standard user on the box, but once there, exploitation is low-complexity, requires no user interaction, and yields high impact across confidentiality, integrity, and availability - i.e. SYSTEM-level compromise of a single host. EPSS data was not provided in the input and the CVE is not on the CISA KEV list, so there is no current signal of mass or targeted in-the-wild exploitation; no public exploit identified at time of analysis. Realistically this is a second-stage vulnerability - low standalone internet-facing risk, but high value to ransomware, commodity malware, and red teams that have already landed user-level code and need to escape to kernel/SYSTEM, so it should be patched on the normal Microsoft monthly cadence rather than ignored as 'just local'.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via a phishing-delivered loader running as the logged-in user - opens a handle to the ProjFS filter driver and issues a crafted IOCTL or ProjFS callback that triggers the out-of-bounds read in prjflt.sys, leaking kernel memory contents that reveal pointers needed to defeat KASLR or directly corrupting a security-relevant structure. The attacker chains the disclosure into a kernel write primitive (or a follow-on bug) to overwrite their process token, ending the session as NT AUTHORITY\SYSTEM with no user interaction required.