Windows Projected File System CVE-2026-50469

Requires the attacker to already hold local, authenticated standard-user access to the target Windows machine (AV:L/PR:L), and the vulnerable Windows Projected File System driver must be present/active on the host (default in the affected Windows 10/11 and Server 2019-2025 SKUs). Exploitation hinges on the attacker being able to create symbolic links, junctions, or reparse points and win a link-resolution race against a privileged ProjFS file operation. Limiting factors: it cannot be triggered remotely or by an unauthenticated user, needs no user interaction (UI:N) but does need prior foothold on the box, and value is highest on multi-user systems (RDS/terminal servers, shared build agents) where an initial low-privilege account is meaningful; on single-user endpoints the attacker must first obtain local execution by other means.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, and full confidentiality/integrity/availability impact, which is the classic profile of a reliable local EoP. Against that, real-world urgency is tempered: it requires the attacker to already have local code execution as a standard user, no public exploit has been identified, and it is not in CISA KEV, so this is not a mass-exploitable remote issue. Note a signal conflict worth flagging: the CVSS vector and Microsoft's classification describe elevation of privilege (C:H/I:H/A:H), yet the source Tags label it 'Information Disclosure' - verify the precise impact category against the MSRC advisory, as the vector is the more authoritative indicator here. No EPSS score and no SSVC decision data were provided, so exploitation-probability signals are absent; treat this as a standard Patch-Tuesday-class local EoP: important to patch on multi-user, terminal-server, and shared-host systems, lower urgency on single-user endpoints.

A local attacker who already has standard-user access on a Windows host (for example after phishing-delivered code execution or on a shared terminal server) plants a malicious symbolic link or junction and triggers a ProjFS-mediated file operation, winning a race so the privileged operation follows the link to an attacker-chosen target. This lets them overwrite or create a protected file and escalate from limited user to SYSTEM. No public proof-of-concept has been identified at time of analysis, and the low attack complexity (AC:L) suggests a reliable exploit is feasible once code is developed.