CVE-2026-32069

What it actually does

This is a local elevation-of-privilege vulnerability caused by a double-free memory corruption flaw in the Windows Projected File System component. A low-privileged, authenticated attacker who can run code on an affected Windows host may be able to trigger incorrect memory handling in the ProjFS kernel/file-system path and execute code with elevated privileges, potentially up to SYSTEM-level control. The CVSS vector indicates local access is required, attack complexity is low, no user interaction is required, and successful exploitation can compromise confidentiality, integrity, and availability of the affected host.

Why it matters to the business

The main business risk is that an attacker who already has a foothold on a Windows workstation or server could turn limited access into full local control, enabling credential theft, security tool tampering, lateral movement, data access, and persistence. This is especially important for shared workstations, developer systems, jump hosts, and Windows servers where local privilege escalation can convert a contained compromise into broader domain or operational impact. The vulnerability affects many supported Windows 10, Windows 11, and Windows Server versions, so enterprise exposure may be broad even though current EPSS is low, stable, not listed in CISA KEV, and there is no public exploit maturity reported.

How an attack unfolds

An attacker first needs valid local code execution on an affected Windows system, such as through malware execution, phishing, abuse of an exposed service account, or compromise of a low-privileged user session. The attacker then invokes functionality that reaches the Windows Projected File System driver or related file-system handling paths and triggers the double-free condition. By carefully shaping heap state and timing object allocation and release, the attacker attempts to turn the memory corruption into privileged code execution or token manipulation. If successful, the attacker obtains elevated local privileges, commonly targeting SYSTEM-level execution, then may dump credentials, disable security controls, install persistence, access protected files, or use the host as a staging point for lateral movement. No named threat actors or active ransomware use are currently associated with the provided intelligence.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no fixed package versions were provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the latest cumulative security update applicable to each OS build. Prioritize internet-facing servers, shared-user systems, developer workstations, privileged access workstations, jump hosts, and systems where low-privileged users can execute code. If immediate patching is not possible, reduce risk by removing unnecessary local logon rights, limiting interactive access to servers, enforcing application control, monitoring and restricting use of ProjFS where not needed, and ensuring endpoint protection and tamper protection are enabled. Disabling or removing the Windows Projected File System optional feature may reduce exposure where business applications do not require it, but this should be tested carefully because developer tools and virtualization workflows may depend on it.

How to confirm the fix worked

Confirm remediation by verifying that each affected host has installed the Microsoft cumulative security update released for this vulnerability or a later superseding update. Validate the OS build and patch level with Windows Update history, enterprise patch-management reporting, PowerShell inventory, or vulnerability scanner checks that specifically evaluate CVE coverage rather than only OS version. Confirm whether the ProjFS feature is enabled with Windows optional feature inventory and whether the prjflt driver is present or loaded, but treat feature state as exposure context rather than proof of vulnerability. Where practical, run an authenticated vulnerability scan after patching and compare results against Microsoft Security Update Guide applicability. For high-value systems, verify that there are no unexpected crashes, kernel bugchecks, or suspicious privilege-escalation artifacts around the period before patch deployment.

Typical attack path

1. Gain initial local access to an affected Windows workstation or server as a standard user or low-privileged service account.
2. Confirm the host is an affected Windows version and that the Projected File System component or driver path is reachable.
3. Run a local exploit that exercises the vulnerable ProjFS memory-management path.
4. Trigger the double-free condition and manipulate kernel memory behavior to obtain elevated execution.
5. Spawn an elevated shell or process, often as SYSTEM or another privileged security context.
6. Use elevated access to disable defenses, access sensitive files, dump credentials, install persistence, or move laterally.

How to detect it

There are no reliable public exploit-specific indicators in the provided intelligence, and successful exploitation of a kernel memory corruption issue may leave limited forensic traces. Detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs, Sysmon or EDR process telemetry, PowerShell logs, driver/service events, crash dumps, and endpoint alerts. Look for standard-user processes that unexpectedly spawn elevated cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, wmic.exe, certutil.exe, procdump.exe, taskmgr.exe, or credential-access tools under SYSTEM or high-integrity contexts. Investigate recent enablement or loading of the Projected File System feature or prjflt driver on systems where it is not normally used. Review System event logs for bugchecks, application crashes, unexpected driver faults, or service-control activity involving prjflt around the time of suspicious elevation. Also look for follow-on activity: LSASS access, creation of new local administrators, security tool disablement, scheduled tasks, new services, suspicious WMI persistence, RDP enablement, and lateral movement attempts. Because many ProjFS artifacts can be legitimate, correlate them with user context, timing, process ancestry, command line, and whether the host is expected to use developer or virtualization tooling.

• C:\Windows\System32\drivers\prjflt.sys
• HKLM\SYSTEM\CurrentControlSet\Services\prjflt
• Client-ProjFS
• Enable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS
• DISM /Online /Enable-Feature /FeatureName:Client-ProjFS
• dism.exe /Online /Enable-Feature /FeatureName:Client-ProjFS
• fltmc load prjflt
• sc start prjflt
• prjflt
• Microsoft-Windows-Kernel-Power
• Event ID 41
• Event ID 1001
• Event ID 7045
• lsass.exe
• procdump.exe -ma lsass.exe
• comsvcs.dll, MiniDump
• net localgroup administrators /add
• powershell.exe -ExecutionPolicy Bypass
• schtasks /create
• reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• wevtutil cl Security

What your security team should do

• Patch affected Windows endpoints and servers with the applicable Microsoft cumulative security update or later superseding update.
• Prioritize systems that allow local user execution, shared administrative access, developer workflows, remote desktop access, or server logons by non-administrators.
• Inventory where the Windows Projected File System feature and prjflt driver are enabled, and disable the feature where it is not required after compatibility testing.
• Harden local privilege boundaries by removing unnecessary local administrator rights and limiting interactive logon to servers.
• Use EDR/Sysmon to alert on low-privileged user processes spawning SYSTEM shells or administrative tools shortly after interacting with file-system drivers or ProjFS-related commands.
• Review endpoint telemetry for signs of privilege escalation, credential dumping, defense evasion, and lateral movement rather than relying on a single exploit-specific indicator.
• Because EPSS is currently low and there is no KEV listing or known public exploit maturity, handle this as important routine patching unless compensating factors increase local-execution risk.