Windows ProjFS EUVD-2026-56652

Exploitation requires an authenticated local user session - an attacker must already have code running under a standard (low-privilege) Windows account on the target system. The Windows Projected File System (ProjFS) component must be present and functional on the host; ProjFS ships as an optional feature in Windows 10 1809 and later and may be disabled on systems where it is not needed. No network-facing attack surface exists: the vulnerability is strictly local. Limiting factors are: (1) the attacker must have achieved initial local code execution first; (2) disabling ProjFS eliminates the attack surface at the cost of breaking ProjFS-dependent software.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.8, reflecting a locally exploitable, low-complexity flaw requiring only a standard user account with no user interaction. The full C:H/I:H/A:H triad confirms that successful exploitation yields complete control of the affected system. Low attack complexity (AC:L) is a significant aggravating signal: it indicates no race conditions, special timing, or environmental prerequisites beyond possessing a local session. This profile makes CVE-2026-62751 an attractive lateral-movement or post-initial-access escalation tool in multi-user or enterprise environments where threat actors routinely begin with phishing-obtained low-privilege credentials. Counterbalancing this: the vulnerability is not listed in CISA KEV, no public POC has been identified at time of analysis, and exploitation requires an existing local foothold. EPSS data was not provided; absent that signal, urgency is guided primarily by the AC:L/PR:L combination and the breadth of affected Windows versions. This is a genuine patching priority - not inflated by CVSS alone - for any organization with unpatched Windows 10/11 or Windows Server 2022/2025 endpoints.

A threat actor who has obtained a standard Windows user account - through phishing, credential stuffing, or initial-access broker purchase - executes a crafted local process that interacts with the Windows Projected File System driver, supplying malformed parameters that trigger the integer overflow. The resulting kernel memory corruption is then used to overwrite a privileged kernel data structure, granting the attacker SYSTEM-level code execution and full control of the host. No public POC has been identified at time of analysis, but the low attack complexity (AC:L) suggests that exploit development from the patch diff is feasible for skilled adversaries.