What is the CVSS score of EUVD-2026-22509?

EUVD-2026-22509 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by EUVD-2026-22509?

CVE-2026-32078 is a high-severity privilege escalation vulnerability in Windows Projected File System affecting Windows 10, 11, and Server 2019-2025 that allows any authenticated local user to gain…. A patch is available.

How to fix or mitigate EUVD-2026-22509?

Within 24 hours: Inventory all Windows 10, 11, and Server 2019-2025 systems and identify patch versions from Microsoft security advisory for CVE-2026-32078. Within 7 days: Deploy vendor-released patches to all affected endpoints prioritizing servers and systems with remote access or service accounts. Within 30 days: Complete full patching across all Windows infrastructure and verify successful updates via WSUS or endpoint management system; audit local user account permissions to reduce attack surface for privilege escalation.

Microsoft EUVD-2026-22509

| CVE-2026-32078 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

Denial Of Service Use After Free Memory Corruption Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:32 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22509

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Projected File System (ProjFS) across Windows 10, Windows 11, and Windows Server 2019-2025 allows authenticated low-privileged users to gain SYSTEM-level control via use-after-free memory corruption. Attack requires local access and low-privileged credentials (CVSS PR:L) but no user interaction, enabling complete compromise of confidentiality, integrity, and availability. Vendor-released patches are available for all affected versions. No public exploit identified at time of analysis, though the vulnerability class (use-after-free) is well-understood and commonly targeted once details emerge.

Technical ContextAI

Windows Projected File System (ProjFS) is a Windows component enabling virtualized file system providers, commonly used by cloud storage clients and development tools like Git. The vulnerability stems from a use-after-free condition (CWE-416), a memory safety issue where the system accesses freed memory locations. This occurs when ProjFS fails to properly manage object lifetimes during file system operations, allowing a pointer to remain accessible after the underlying memory has been deallocated. Successful exploitation enables arbitrary code execution in the kernel context. The vulnerability affects all modern Windows versions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019-2025, including Server Core installations, indicating a long-standing flaw in the ProjFS implementation across the Windows kernel codebase.

RemediationAI

Apply Microsoft security updates immediately to patch the use-after-free vulnerability in Windows Projected File System. Fixed versions are Windows 10 1809 build 10.0.17763.8644 or later, Windows 10 21H2/22H2 build 10.0.19044.7184/10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Patches are distributed through Windows Update and Microsoft Update Catalog. No effective workarounds exist short of restricting local user access, which is operationally impractical. Prioritize patching systems with multiple local users, terminal servers, and development environments where ProjFS is actively utilized. Full advisory and download links available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32078.