CVE-2026-42828 Overview
CVE-2026-42828 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS) Filter Driver. An authorized local attacker can exploit this flaw to elevate privileges on affected Windows endpoints and servers. The issue is tracked under CWE-126: Buffer Over-read and affects a broad range of supported Windows client and server releases. Microsoft published its advisory through the Microsoft Security Response Center.
Critical Impact
Successful exploitation grants an authenticated local user kernel-level privileges, providing complete control over confidentiality, integrity, and availability on the affected host.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
- Microsoft Windows Server 2019, Server 2022, and Server 2025
Discovery Timeline
- 2026-06-09 - CVE-2026-42828 published to the National Vulnerability Database
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-42828
Vulnerability Analysis
The vulnerability resides in the Windows Projected File System Filter Driver (PrjFlt.sys), a kernel-mode minifilter that projects virtualized file system content into the Windows namespace. ProjFS is used by tools such as Git Virtual File System (GVFS) to materialize files on demand. A buffer over-read condition in the driver allows an attacker holding low privileges to read kernel memory beyond an intended buffer boundary. Because the affected component runs in kernel mode, exploitation results in local privilege escalation with high impact on confidentiality, integrity, and availability. Exploitation requires local access and authenticated, low-privileged execution but no user interaction.
Root Cause
The defect is classified as CWE-126: Buffer Over-read. The driver reads from a buffer using an index or length value derived from attacker-controlled input without sufficient bounds validation. The over-read returns adjacent kernel memory contents, which can leak sensitive structures such as pointers, tokens, or kernel addresses. Disclosed kernel data can then defeat Kernel Address Space Layout Randomization (KASLR) and be combined with other primitives to achieve privilege escalation.
Attack Vector
A local, authenticated attacker invokes ProjFS functionality through I/O Control (IOCTL) requests or file system operations that traverse the filter driver. Crafted inputs trigger the over-read in PrjFlt.sys, returning kernel memory to user mode. The attacker uses the disclosed data to bypass mitigations and escalate to SYSTEM. No network access and no user interaction are required, making the vulnerability practical in scenarios where an attacker already has a foothold on the host.
No public proof-of-concept exploit code is available for CVE-2026-42828. See the Microsoft CVE-2026-42828 Advisory for vendor-supplied technical details.
Detection Methods for CVE-2026-42828
Indicators of Compromise
- Unexpected loading or interaction with PrjFlt.sys from non-developer processes
- Local user processes spawning SYSTEM-level child processes shortly after ProjFS I/O activity
- Anomalous IOCTL traffic to the ProjFS minifilter from unsigned or low-reputation binaries
- Crash dumps referencing PrjFlt.sys with access violations or bug check codes tied to invalid memory reads
Detection Strategies
- Hunt for newly created processes whose parent token integrity escalates from Medium to System without a legitimate elevation path
- Correlate ProjFS provider registrations with the originating user context and binary signing status
- Alert on installations of GVFS or ProjFS-enabled tooling on hosts where they are not part of the approved software baseline
- Compare host patch state against the Microsoft June 2026 security update to identify unpatched endpoints
Monitoring Recommendations
- Centralize Windows Security, Sysmon, and kernel telemetry into an EDR or SIEM for retroactive hunting
- Monitor minifilter altitude changes and driver load events for PrjFlt.sys
- Track privilege escalation patterns such as token duplication and SeImpersonatePrivilege use following ProjFS activity
- Review Microsoft Defender or third-party EDR detections tagged as kernel exploitation attempts
How to Mitigate CVE-2026-42828
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-42828 Advisory to all affected Windows client and server systems
- Prioritize patching multi-user systems such as Remote Desktop Services hosts and developer workstations running GVFS
- Audit local account privileges and remove unnecessary interactive logon rights
- Restrict installation of ProjFS-dependent tooling to systems that require it
Patch Information
Microsoft addresses CVE-2026-42828 in the cumulative security updates released through the Microsoft Update Guide. Administrators should deploy the corresponding Knowledge Base updates for each affected build of Windows 10, Windows 11, and Windows Server. Verify deployment status using Windows Update for Business reports, Microsoft Configuration Manager, or Intune compliance policies.
Workarounds
- Disable the Windows Projected File System optional feature on hosts that do not require it using Disable-WindowsOptionalFeature
- Block execution of GVFS and other ProjFS clients on systems where they are not authorized
- Enforce application allowlisting with Windows Defender Application Control (WDAC) to limit kernel-driver-adjacent code
- Apply the principle of least privilege so that compromised low-privilege accounts have minimal lateral value
# Disable the Projected File System optional feature where not required
Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS -NoRestart
# Verify the feature state after the change
Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
