CVE-2026-34340 Overview
CVE-2026-34340 is a use-after-free vulnerability [CWE-416] in the Windows Projected File System (ProjFS). An authenticated local attacker can exploit the flaw to elevate privileges on affected Windows endpoints and servers. Microsoft published the advisory on May 12, 2026, and the issue impacts a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2019 through 2025. Successful exploitation grants high confidentiality, integrity, and availability impact on the targeted host.
Critical Impact
Local privilege escalation to SYSTEM-level access on Windows hosts running the Projected File System component, enabling full host compromise from a low-privileged user context.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2026-05-12 - CVE-2026-34340 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-34340
Vulnerability Analysis
The Windows Projected File System (ProjFS) is a kernel-mode component that allows user-mode providers to project hierarchical data — such as Git repositories under VFS for Git — into the file system namespace. ProjFS manages provider callbacks, virtualization roots, and per-file metadata structures inside the kernel.
The vulnerability is a use-after-free condition in ProjFS object management. A code path releases a reference to an internal object while another execution path retains and dereferences a stale pointer to the freed allocation. An attacker who can trigger the racing operations can reclaim the freed memory with attacker-controlled data and influence kernel control flow or write primitives.
Exploitation requires local access and valid low-privileged credentials. The advisory notes high attack complexity, indicating the attacker must win a timing window or arrange specific object states. No user interaction is required, and successful exploitation yields code execution in the kernel context.
Root Cause
The root cause is improper lifetime management of a ProjFS kernel object [CWE-416]. Reference counting or object teardown sequences fail to synchronize with concurrent operations, leaving a dangling pointer that is later dereferenced.
Attack Vector
The attack vector is local. An authenticated attacker invokes ProjFS user-mode APIs or filter operations from a low-privileged process to trigger the freed-object dereference. Reliable exploitation typically involves heap grooming inside the relevant kernel pool, followed by spraying replacement objects to gain a write-what-where or arbitrary-read primitive that culminates in token replacement or kernel code execution.
No public proof-of-concept code is currently available, and the issue is not listed in CISA KEV. See the Microsoft CVE-2026-34340 Update Guide for vendor technical details.
Detection Methods for CVE-2026-34340
Indicators of Compromise
- Unexpected loading or interaction with the PrjFlt.sys driver from non-developer or non-Git workloads
- Low-privileged processes opening handles to ProjFS virtualization roots followed by SYSTEM-context child processes
- Kernel bugchecks (BSOD) referencing PrjFlt.sys or ProjectedFSLib.dll, which can indicate failed exploitation attempts
- New services, scheduled tasks, or local administrators created shortly after suspicious ProjFS activity
Detection Strategies
- Hunt for non-elevated processes that call PrjStartVirtualizing or open ProjFS reparse points and subsequently spawn elevated children
- Correlate Windows kernel crash telemetry against the PrjFlt module to surface exploitation attempts
- Apply behavioral analytics that flag token manipulation, parent-child privilege transitions, and integrity-level changes originating from medium-integrity processes
Monitoring Recommendations
- Enable Sysmon process creation (Event ID 1) and image load (Event ID 7) events for PrjFlt.sys and ProjectedFSLib.dll
- Forward Windows kernel and WER crash reports to a centralized SIEM for retroactive hunting
- Audit installation of ProjFS providers and changes to the Microsoft-Windows-ProjFS-Filter registry keys
How to Mitigate CVE-2026-34340
Immediate Actions Required
- Apply the May 2026 Microsoft security updates referenced in the MSRC advisory to all affected Windows 10, Windows 11, and Windows Server systems
- Inventory hosts where the Projected File System optional feature is enabled and prioritize those for patching
- Restrict interactive and remote logon rights for non-administrative users on servers and developer workstations
- Validate that endpoint protection telemetry from ProjFS-enabled hosts is reaching the SOC for monitoring
Patch Information
Microsoft has issued cumulative updates addressing CVE-2026-34340 across all supported Windows client and server SKUs. Refer to the Microsoft CVE-2026-34340 Update Guide for the specific KB articles and build numbers per platform. Patches must be applied through Windows Update, WSUS, Microsoft Update Catalog, or the organization's standard patch management workflow.
Workarounds
- Disable the Projected File System optional feature on hosts that do not require it, particularly servers without Git VFS or similar providers
- Enforce least-privilege policies and remove standard users from groups that allow local logon to sensitive systems
- Apply application control policies to block untrusted binaries from invoking ProjFS user-mode APIs
# Check whether the Projected File System feature is enabled
DISM /Online /Get-FeatureInfo /FeatureName:Client-ProjFS
# Disable the Projected File System feature where not required
DISM /Online /Disable-Feature /FeatureName:Client-ProjFS /NoRestart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
