CVE-2026-42837

What it actually does

CVE-2026-42837 is a local privilege escalation vulnerability in the Windows Projected File System Filter Driver. The flaw is described as a buffer over-read, meaning the driver can read memory beyond the intended bounds of a buffer during local file-system filter operations. Because the vulnerable component runs in a privileged Windows kernel context, a low-privileged authenticated local attacker who can trigger the vulnerable code path may be able to elevate privileges and gain high-integrity or SYSTEM-level control. The CVSS vector indicates local access is required, attack complexity is low, user interaction is not required, and successful exploitation can affect confidentiality, integrity, and availability.

Why it matters to the business

Successful exploitation could allow an attacker who already has a foothold on a Windows workstation or server to take full control of that system. This can turn a limited compromise, such as a compromised standard user account or malware running with low privileges, into administrative control, enabling credential theft, security tool tampering, lateral movement, data access, and persistence. The issue affects multiple supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Although it is not currently listed in CISA KEV, has no known exploit maturity, and has low EPSS with a flat 30-day trend, local privilege escalation flaws are commonly chained with phishing, remote access, or application compromise in real-world intrusions.

How an attack unfolds

An attacker must first obtain local code execution on an affected Windows system using another technique, such as stolen credentials, malware execution, exploitation of a separate application vulnerability, or abuse of remote management access. Once running as a low-privileged user, the attacker invokes crafted operations that interact with the Windows Projected File System Filter Driver. The crafted activity causes the driver to perform an out-of-bounds memory read. If the attacker can reliably use the memory disclosure or corrupted execution behavior to influence privileged kernel operations, they may escalate from a standard user context to administrative or SYSTEM privileges. With elevated privileges, the attacker can disable protections, dump credentials, install persistence, access sensitive files, and move laterally. No public exploitation or named threat actor use is indicated in the provided data, so organizations should prioritize patching based on exposure of Windows endpoints and servers rather than evidence of active exploitation.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, Microsoft Configuration Manager, or other enterprise patch management tooling. Because no exact fixed build numbers were provided, use Microsoft’s official CVE guidance and monthly cumulative update documentation to identify the applicable patched cumulative update for each Windows release. Prioritize Windows servers, administrator workstations, developer workstations, shared systems, and internet-adjacent systems where a separate initial-access vulnerability could be chained with local privilege escalation. If immediate patching is not possible, reduce risk by limiting local interactive access, removing unnecessary user privileges, enforcing application control, enabling attack surface reduction rules, monitoring for suspicious local privilege escalation behavior, and ensuring endpoint protection and tamper protection are active. There is no reliable generic workaround for a kernel-mode memory corruption issue other than applying the vendor fix; disabling Projected File System-related functionality should only be considered if Microsoft documents it as a supported mitigation and if business impact is understood.

How to confirm the fix worked

Confirm remediation by verifying that affected systems have installed the Microsoft cumulative update or security update that supersedes this vulnerability for their Windows version. Use centralized patch reporting from Microsoft Defender Vulnerability Management, Intune, WSUS, Configuration Manager, or equivalent endpoint management platforms to identify systems still running vulnerable builds. On individual hosts, validate the OS version and installed hotfixes using tools such as Windows Update history, systeminfo, Get-HotFix, DISM package inventory, or enterprise vulnerability scanner checks. Re-scan with an authenticated vulnerability scanner after patch deployment and confirm the CVE is no longer reported. Where possible, test representative Windows 10, Windows 11, and Windows Server systems in a staging ring before broad rollout to ensure file-system filter driver compatibility with endpoint security, backup, DLP, virtualization, developer, and storage tools.

Typical attack path

1. Gain initial local code execution on an affected Windows workstation or server as a low-privileged authenticated user.
2. Identify that the target is running a vulnerable Windows version with the Projected File System Filter Driver present.
3. Trigger crafted local file-system or projection-related operations that reach the vulnerable driver code path.
4. Exploit the buffer over-read condition to obtain privileged memory disclosure or otherwise support privilege escalation.
5. Escalate privileges to administrator or SYSTEM-level execution.
6. Use elevated access to dump credentials, disable security controls, install persistence, access sensitive data, or move laterally.

How to detect it

Because this is a local kernel driver privilege escalation vulnerability and no public exploit indicators were provided, detection should focus on post-exploitation behaviors rather than a unique network signature. Review endpoint telemetry and Windows logs from affected, unpatched systems for unusual transitions from low-privileged user activity to SYSTEM or administrator-level execution. Relevant sources include EDR process and memory telemetry, Windows Security logs, Sysmon logs, Microsoft Defender for Endpoint alerts, PowerShell logs, service control manager logs, driver load events, and file-system activity telemetry if available. Look for suspicious process creation as SYSTEM shortly after execution by a normal user, unexpected service installation, scheduled task creation, credential dumping tools, attempts to disable security products, abnormal access to LSASS, suspicious kernel driver loading, and exploitation attempts involving Projected File System-related components. Since no named threat actors, ransomware usage, or known exploit maturity are indicated, absence of specific IOCs does not prove absence of exploitation; rely on behavioral hunting, patch status correlation, and investigation of suspicious privilege elevation chains.

• Projected File System
• ProjFS
• PrjFlt
• PrjFlt.sys
• Service Control Manager
• A service was installed in the system
• Event ID 4697
• Event ID 7045
• Event ID 4672
• Event ID 4688
• Event ID 1
• Event ID 6
• lsass.exe
• comsvcs.dll, MiniDump
• procdump.exe -ma lsass.exe
• rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump
• sc.exe create
• schtasks.exe /Create
• wevtutil.exe cl
• powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true

What your security team should do

• Track Microsoft’s official advisory for the exact cumulative updates or build numbers that remediate this vulnerability and deploy them through normal emergency or monthly patch channels.
• Prioritize patching of Windows servers, privileged access workstations, jump hosts, VDI images, shared workstations, and endpoints used by administrators or developers.
• Use vulnerability management tooling to inventory affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets and monitor remediation progress.
• Treat this primarily as a post-compromise privilege escalation risk: review recent low-privilege malware, suspicious logons, and endpoint alerts on unpatched systems.
• Harden endpoints by enforcing least privilege, removing unnecessary local administrator rights, enabling Microsoft Defender or equivalent EDR, enabling tamper protection, and applying application control where feasible.
• Monitor for signs of local privilege escalation, suspicious child processes running as SYSTEM, unexpected service creation, driver-loading activity, credential dumping, and security control disablement.
• If exploitation details become public or the CVE is added to KEV, accelerate remediation timelines and increase threat hunting on remaining unpatched systems.