Windows ProjFS EUVD-2026-22479

Requires an attacker who is already an authorized, low-privileged local user on the Windows host (PR:L, AV:L) - there is no remote or network vector. Exploitation depends on the Windows Projected File System (ProjFS) feature being active (ProjFS is used by virtual-filesystem providers such as VFS for Git / Scalar), and on the attacker winning an improper-synchronization race condition, which the CVSS AC:H and SSVC 'Automatable: no' indicate is timing-sensitive and not reliably repeatable. No user interaction is required (UI:N). The chief limiting factors are the need for prior local authenticated access, the dependence on ProjFS being in use, and the difficulty of reliably winning the race.

Signals here are largely consistent and point to a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a local elevation-of-privilege flaw requiring an already-authenticated low-privileged user and a hard-to-win race condition (AC:H), yielding total impact (C:H/I:H/A:H) - consistent with CISA SSVC 'Technical Impact: total'. The exploitation-likelihood signals all point down: EPSS is 0.04% (12th percentile), SSVC Exploitation is 'none' and Automatable is 'no', there is no CISA KEV listing, and no public exploit identified at time of analysis. The high AC combined with 'Automatable: no' reflects the timing-dependent nature of the race, which limits reliable mass exploitation. One inconsistency must be flagged: the input Tags include 'Information Disclosure', but the description, CWE-362, and the I:H/A:H impact all describe privilege elevation, not disclosure - treat the 'Information Disclosure' label as suspect and rely on the EoP characterization. Net: a real local EoP worth patching in the normal cycle, most relevant as a post-compromise/privilege-escalation link rather than an initial-access or wormable threat.

A local, low-privileged but authenticated attacker who already has code execution on a Windows host with the Projected File System (ProjFS) feature in use repeatedly triggers concurrent operations against ProjFS to win an improper-synchronization race. Winning the race lets them manipulate shared resources to execute code or gain rights at a higher privilege level (up to SYSTEM). No public exploit is identified at time of analysis, and the high attack complexity means exploitation is timing-dependent and not reliably repeatable.