CVE-2026-42828

What it actually does

This vulnerability is a local privilege escalation flaw in the Windows Projected File System Filter Driver, caused by a buffer over-read condition. An attacker who already has valid low-privileged local access to an affected Windows workstation or server could trigger the flaw to read memory outside the intended bounds and potentially manipulate execution in a way that gains elevated privileges. Because the CVSS vector requires local access and low privileges but no user interaction, the issue is most relevant as a post-compromise escalation technique rather than an initial entry vector. Successful exploitation could compromise confidentiality, integrity, and availability at the operating-system level.

Why it matters to the business

If exploited, this flaw could allow an attacker who has already gained a foothold on an affected Windows system to become an administrator or SYSTEM-level user, increasing the likelihood of credential theft, security-tool tampering, lateral movement, data theft, and ransomware deployment. The issue affects a broad range of supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has no reported mature public exploit, and has a low EPSS score that has remained flat over 30 days, so urgency is lower than actively exploited Windows privilege-escalation bugs; however, it should still be remediated through normal patch governance because local elevation flaws are commonly chained with phishing, exposed services, stolen credentials, or malware execution.

How an attack unfolds

An attacker first needs local code execution or an authenticated local session on an affected Windows system. This could come from phishing, abuse of valid credentials, exploitation of a separate remote-code-execution vulnerability, malware delivery, or access through an already-compromised user account. Once running with low privileges, the attacker would interact with functionality handled by the Windows Projected File System Filter Driver and trigger the vulnerable buffer over-read condition. If the exploit is reliable, the attacker could elevate privileges from a standard user context to a highly privileged local context, such as administrator or SYSTEM. With elevated privileges, the attacker could disable defenses, dump credentials, install persistence, access protected files, move laterally, or prepare the system for destructive or ransomware activity. No public exploit maturity or named threat-actor activity is currently reported for this CVE.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-42828 for all affected Windows versions: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no exact fixed build or KB version was provided, use the applicable Microsoft Security Update Guide entry and standard Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch-management tooling to deploy the relevant cumulative update. Prioritize systems where local compromise would be especially damaging, including domain-joined servers, administrator workstations, virtualization hosts, build systems, file servers, and systems used by privileged users. As interim risk reduction, enforce least privilege, remove unnecessary local administrator rights, restrict interactive logon to servers, apply application control where feasible, monitor suspicious driver and privilege-escalation behavior, and ensure endpoint detection controls are active and tamper-protected.

How to confirm the fix worked

Confirm exposure by inventorying Windows assets and identifying affected versions and builds across supported client and server fleets. Validate remediation by confirming that the applicable Microsoft cumulative security update for this CVE is installed and that the OS build level matches or exceeds the fixed build listed by Microsoft for each Windows release. Use centralized patch reporting from Windows Update for Business, WSUS, Microsoft Configuration Manager, Intune, vulnerability scanners, or endpoint-management tools. On individual hosts, review installed hotfixes, cumulative update history, and OS build information using standard Windows administration methods such as Settings, winver, systeminfo, Get-ComputerInfo, Get-HotFix, or equivalent enterprise tooling. After patching, reboot systems where required and rescan to verify the vulnerability is no longer detected. If a scanner continues to report exposure, confirm that the scanner has current vulnerability definitions and that the host has completed any pending reboot.

Typical attack path

1. Obtain initial access to an affected Windows workstation or server using another technique such as phishing, stolen credentials, malware, or exploitation of a separate vulnerability.
2. Execute code locally as a low-privileged authenticated user.
3. Invoke operations that reach the Windows Projected File System Filter Driver.
4. Trigger the buffer over-read condition in the driver.
5. Use the memory corruption or information exposure behavior to achieve local privilege escalation.
6. Run follow-on actions with elevated privileges, such as credential dumping, persistence creation, defense evasion, lateral movement, data theft, or ransomware staging.

How to detect it

There are no public exploit-specific indicators or named threat-actor campaigns reported for this vulnerability at this time, so detection should focus on post-compromise privilege-escalation behavior rather than a unique signature. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, driver activity, and process-creation events for low-privileged user processes that unexpectedly spawn elevated shells, create new administrator accounts, alter local group membership, disable security tools, dump credentials, or install persistence shortly before or after suspicious activity. Relevant Windows log sources include Security event logs for logon activity and privilege use, process creation telemetry if enabled, Sysmon process and driver events, PowerShell Script Block logs, Microsoft Defender for Endpoint alerts, and EDR detections related to local privilege escalation or credential theft. Investigate sequences where a standard user context rapidly transitions into administrator or SYSTEM-level execution without an expected administrative tool, software deployment job, or helpdesk workflow. Because exploitation requires prior local access, correlate any suspected elevation activity with earlier signs of initial access such as suspicious downloads, malicious Office or script execution, anomalous remote logons, unusual scheduled tasks, or unexpected service creation.

What your security team should do

• Patch affected Windows workstations and servers through the normal monthly security-update process, with elevated priority for servers, privileged-access workstations, and systems used by administrators.
• Use asset inventory to identify all affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems.
• Verify patch deployment with both endpoint-management reporting and independent vulnerability scanning after required reboots.
• Review local administrator group membership and remove unnecessary privileged access from users and service accounts.
• Harden post-compromise controls: enable tamper protection, credential-theft protections, attack-surface-reduction rules, and application control where feasible.
• Monitor for suspicious local privilege-escalation behavior, including unusual low-privileged processes spawning elevated shells, credential-dumping tools, or security-control modification commands.
• Treat detections involving this vulnerability as post-compromise activity and investigate the initial access path, lateral movement, persistence, and credential exposure, not just the local host event.
• Track Microsoft advisories for updated fixed build details, exploitability assessment changes, or any indication of public exploit availability or active exploitation.