Microsoft EUVD-2026-22491

Windows Projected File System (ProjFS) is a kernel-mode driver framework introduced in Windows 10 version 1809 that enables user-mode applications to project virtual file systems into the Windows namespace, commonly used by cloud storage providers and development tools. The vulnerability stems from a double-free condition (CWE-415), a class of memory corruption where the same memory region is deallocated twice, potentially corrupting heap metadata and enabling arbitrary code execution. When exploited in kernel context, double-free bugs allow attackers to manipulate kernel memory structures, leading to privilege escalation from low-privileged user to SYSTEM. The widespread CPE coverage indicates the vulnerability exists in the core ProjFS driver implementation shared across Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server (2019, 2022, 2025) including Server Core installations. Microsoft's classification under 'Information Disclosure' tag alongside privilege escalation suggests the double-free may also leak kernel memory contents before achieving full exploitation.