Windows Server 2019 EUVD-2026-22491

Local user account required on Windows system with Projected File System (ProjFS) enabled. Attacker must have authenticated logon capability to the target machine.

Real-world risk is HIGH for organizations with insufficient endpoint privilege management but MODERATE for hardened environments. CVSS 7.8 accurately reflects significant impact (complete system compromise: C:H/I:H/A:H) but requires local access with low-level privileges (AV:L/PR:L), limiting initial attack surface. Attack complexity is LOW (AC:L) with no user interaction (UI:N), meaning exploitation is reliable once an attacker has local access. The absence of scope change (S:U) confines impact to the vulnerable component but full SYSTEM privileges enable lateral movement. No EPSS score provided limits probabilistic risk quantification. Critically, no confirmed active exploitation (not in CISA KEV) and no public exploit identified at analysis time reduces immediate urgency. However, memory corruption in Windows kernel drivers historically attracts sophisticated threat actors for post-exploitation and persistence. SSVC decision factors: Exploitation=None (currently), Automatable=No (requires local context), Technical Impact=Total (SYSTEM access). Priority should escalate in environments where users have local admin rights on endpoints or where initial access vectors (phishing, supply chain) are prevalent. Patch priority: HIGH for internet-facing systems with local users, MEDIUM for isolated/VDI environments with strong privilege controls.

An authenticated local user crafts a malicious file operation targeting ProjFS's double free vulnerability, corrupting kernel heap memory. This allows arbitrary code execution with SYSTEM privileges, escalating from standard user to administrator.