CVE-2026-32074

What it actually does

This vulnerability is a local elevation-of-privilege flaw caused by a double-free memory corruption condition in the Windows Projected File System component. An attacker who already has valid low-privileged local code execution can trigger the vulnerable code path to corrupt kernel or privileged memory management state, potentially allowing execution of code with higher privileges. Successful exploitation can provide full confidentiality, integrity, and availability impact on the affected Windows host.

Why it matters to the business

If exploited, this flaw can allow an attacker who has already gained a foothold on a Windows workstation or server to become highly privileged, disable security controls, access sensitive data, install persistence, or move laterally. The risk is most relevant after phishing, malware execution, stolen credentials, or exploitation of another vulnerability that gives an attacker initial local access. It is not currently listed in CISA KEV, has no known mature public exploit, and has low EPSS activity, but privilege-escalation flaws are commonly chained with other attacks and should still be patched through normal Windows security update processes.

How an attack unfolds

An attacker first obtains the ability to run code locally as a standard authenticated user on an affected Windows system. The attacker then invokes functionality that interacts with the Windows Projected File System component and triggers the double-free condition. By shaping memory layout and repeatedly exercising the vulnerable path, the attacker attempts to turn memory corruption into controlled code execution or token manipulation in a privileged context. If successful, the attacker elevates from a low-privileged account to administrator or SYSTEM-level privileges, after which they can dump credentials, tamper with endpoint defenses, install persistence, or use the compromised host as a pivot point.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including supported releases of Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No specific fixed build numbers were provided in the input, so use the applicable Microsoft cumulative security update for the affected operating system release. Prioritize systems where untrusted users can log in, shared workstations, developer systems, jump hosts, terminal servers, VDI hosts, and servers that are frequently accessed interactively. If immediate patching is not possible, reduce risk by restricting local logon rights, limiting who can run code on affected systems, enforcing least privilege, monitoring for suspicious privilege escalation behavior, and ensuring endpoint protection and tamper protection are enabled. Do not rely on disabling individual services unless Microsoft provides a supported mitigation, because the vulnerable component may be loaded as part of normal operating system functionality.

How to confirm the fix worked

Confirm that each affected Windows system has installed the relevant Microsoft cumulative security update released for this vulnerability or a later superseding update. Validate through enterprise patch management, Windows Update history, Microsoft Update Catalog metadata, or PowerShell inventory of installed hotfixes and OS build numbers. Confirm that Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems are no longer reporting the vulnerability in authenticated vulnerability scans. Where possible, verify that the Projected File System driver and related binaries are at the patched version supplied by Microsoft. Reboot systems after patching when required, because kernel-mode and file-system filter driver updates may not be fully active until restart.

Typical attack path

1. Gain initial local code execution on an affected Windows workstation or server using phishing, malware, stolen credentials, or another vulnerability.
2. Run a local exploit that targets the Windows Projected File System double-free condition.
3. Trigger the vulnerable Projected File System code path while manipulating process or kernel memory state.
4. Achieve privilege escalation to administrator or SYSTEM-level access.
5. Use elevated privileges to disable defenses, access protected data, dump credentials, persist, or move laterally.

How to detect it

There are no reliable public exploit-specific indicators from the provided data, and local privilege-escalation vulnerabilities often leave few unique artifacts. Detection should focus on behavioral evidence of attempted or successful privilege escalation. Review endpoint detection telemetry, Sysmon, Windows Security logs, System logs, crash dumps, and EDR process lineage for low-privileged user processes that unexpectedly create services, spawn elevated shells, access credential stores, disable security tools, or transition to SYSTEM-level execution. Look for system crashes, application faults, or bugchecks around the time of suspicious local activity involving the Windows Projected File System driver or related file-system filter activity. Useful Windows log sources include Security events for process creation and privilege use, service installation events, scheduled task creation, PowerShell logs, Defender/EDR alerts, System events for driver or service failures, and memory dump artifacts. Because this issue is not currently in KEV, is not reported as ransomware-used, and has no known mature exploit in the input, detections should be tuned as anomaly and post-exploitation analytics rather than high-confidence signature matches.

• prjflt.sys
• PrjFlt
• Projected File System
• Windows Projected File System
• ProjectedFSLib.dll
• KERNEL_MODE_HEAP_CORRUPTION
• SYSTEM_SERVICE_EXCEPTION
• Event ID 7045
• SeDebugPrivilege
• whoami /priv
• whoami /all
• cmd.exe /c whoami
• net localgroup administrators
• sc.exe create
• schtasks /create
• powershell.exe -EncodedCommand

What your security team should do

• Patch affected Windows endpoints and servers through the normal Microsoft cumulative update process, prioritizing interactive multi-user systems and high-value administrative workstations.
• Use authenticated vulnerability scanning or endpoint management inventory to identify Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems missing the relevant security update.
• Monitor for suspicious local privilege escalation patterns, especially low-privileged user processes spawning SYSTEM-level shells, credential tools, service creation, or security-control tampering.
• Harden initial-access controls because this vulnerability requires local authenticated execution: enforce MFA, reduce local admin rights, restrict script execution, and block untrusted binaries where feasible.
• Review EDR alerts and Windows logs for crashes or anomalous activity involving the Windows Projected File System driver, followed by privilege changes or suspicious post-exploitation behavior.
• Treat exploitation as a potential full host compromise and initiate credential hygiene actions if evidence shows a low-privileged process obtained administrative or SYSTEM-level access.