Windows ProjFS CVE-2026-84009

Requires that the Windows Projected File System (ProjFS) feature is in use/enabled on the target, since the flaw is in that component. The attacker must already have local, authenticated low-privileged access to the machine (AV:L, PR:L) - this is not remotely reachable. Exploitation is further limited by high attack complexity (AC:H): the attacker must reliably win a time-of-check/time-of-use race window (CWE-367), which is timing-dependent and not guaranteed on any single attempt. No user interaction by a victim is required (UI:N). Impact is confined to integrity/tampering with no confidentiality or availability effect.

This is a low-to-moderate priority issue, not an emergency. The CVSS 3.1 base score of 4.7 (Medium) is driven by local-only access (AV:L), high attack complexity (AC:H), and a requirement for existing low privileges (PR:L), with impact limited to integrity/tampering (I:H) and no confidentiality or availability loss (C:N/A:N). All signals point in the same low-urgency direction and do not conflict: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, which aligns with a race-condition flaw that cannot be reliably or automatically triggered. No EPSS score was supplied in the input, and the CVE is not listed in CISA KEV, with no public proof-of-concept provided. The AC:H metric reflects the inherent unreliability of exploiting a TOCTOU (CWE-367) race window, meaning successful attacks require precise timing and are not well-suited to mass exploitation. Overall this is a genuine-but-contained local tampering defect appropriate for normal patch-cycle remediation rather than out-of-band response.

A local, low-privileged but authenticated user who already has a foothold on a Windows system with the Projected File System feature in use repeatedly performs an operation against a ProjFS-backed path, racing the window between the system's security/state check and its subsequent use of the file. By winning this timing window they substitute or alter the target so the privileged ProjFS operation acts on attacker-controlled data, tampering with integrity. No public exploit code was identified in the provided data, and the high attack complexity means success is probabilistic rather than guaranteed.