CVE-2026-62751 Overview
CVE-2026-62751 is an integer overflow vulnerability in the Windows Projected File System (ProjFS). An authorized local attacker can trigger the overflow to elevate privileges on affected Windows client and server builds. The flaw is tracked under CWE-190: Integer Overflow or Wraparound and affects a wide range of Windows 10, Windows 11, and Windows Server versions.
Microsoft published the advisory through the Microsoft Security Response Center. The vulnerability requires local access and low privileges, but no user interaction, and can compromise confidentiality, integrity, and availability of the host.
Critical Impact
A successful exploit yields SYSTEM-level privileges on the target Windows host, enabling full control over the endpoint.
Affected Products
- Microsoft Windows 10 21H2 and 22H2 (x86, x64, ARM64)
- Microsoft Windows 11 23H2, 24H2, 25H2, and 26H1 (x64, ARM64)
- Microsoft Windows Server 2022 and Windows Server 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62751 published to the National Vulnerability Database
- 2026-08-11 - Microsoft releases security update via MSRC advisory
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62751
Vulnerability Analysis
The Windows Projected File System (ProjFS) is a kernel-mode component that allows user-mode providers to project hierarchical data as files and directories into the local filesystem. It underpins features such as Git Virtual File System (GVFS) and Microsoft Dev Drive. Because ProjFS runs privileged code that consumes provider-supplied metadata, arithmetic errors in that path expose SYSTEM to local attackers.
CVE-2026-62751 is classified as CWE-190: Integer Overflow or Wraparound. An arithmetic calculation involving attacker-influenced size or offset values wraps past the maximum integer bound. The wrapped value is then used in a subsequent memory operation, producing an undersized allocation or out-of-bounds access that a standard user can turn into a privilege escalation primitive.
Root Cause
The root cause is unchecked arithmetic on values supplied through the ProjFS interface between user-mode providers and the kernel-mode driver. When the computed length or offset exceeds the width of the destination integer type, the value wraps to a small number. Downstream code trusts this value and operates on kernel memory buffers, breaking the assumed size invariants.
Attack Vector
Exploitation requires an authenticated local user on the target system. The attacker interacts with the ProjFS interface using crafted parameters that cause the integer wrap. Once the corrupted operation executes in the kernel-mode driver, the attacker leverages the resulting memory corruption to overwrite privileged structures and elevate the current process token to SYSTEM.
No network access or user interaction is required. Consult the Microsoft Security Update CVE-2026-62751 advisory for build-specific details.
Detection Methods for CVE-2026-62751
Indicators of Compromise
- Unexpected loading or heavy activity from PrjFlt.sys or the ProjFS provider service on hosts that do not use Git VFS, Dev Drive, or similar features.
- Local user processes spawning cmd.exe, powershell.exe, or services.exe as NT AUTHORITY\SYSTEM shortly after ProjFS API activity.
- Kernel bugchecks or crash dumps referencing ProjFS routines during or after suspicious user-mode activity.
Detection Strategies
- Alert on non-administrative processes issuing ProjFS control codes or opening handles to ProjFS reparse points outside expected developer workflows.
- Correlate token elevation events with recent ProjFS filter driver activity in the same process lineage.
- Hunt for new services, scheduled tasks, or persistence primitives created immediately after ProjFS-related syscalls by a standard user.
Monitoring Recommendations
- Enable Windows kernel driver telemetry and forward Sysmon Event IDs 1, 10, and 11 to a central analytics platform.
- Monitor patch state of the ProjFS driver across the fleet and flag hosts running pre-patch builds of PrjFlt.sys.
- Track process integrity level transitions from Medium to System for endpoints where developer tooling is not authorized.
How to Mitigate CVE-2026-62751
Immediate Actions Required
- Deploy the August 2026 Microsoft security updates referenced in the MSRC advisory to all affected Windows 10, Windows 11, and Windows Server builds.
- Prioritize multi-user hosts, developer workstations, and Remote Desktop or virtual desktop servers where standard users can execute code.
- Audit which endpoints have the ProjFS optional feature enabled and confirm patch installation on those systems first.
Patch Information
Microsoft addressed CVE-2026-62751 in the security update published on 2026-08-11 through the Microsoft Security Update CVE-2026-62751 advisory. Apply the cumulative update corresponding to each affected build listed above. Windows Server 2022 and Windows Server 2025 receive updates through the standard servicing channel.
Workarounds
- Disable the Windows Projected File System optional feature on hosts that do not require Git VFS, Dev Drive, or other ProjFS-dependent applications.
- Restrict interactive and Remote Desktop logon rights on affected servers to trusted administrative accounts until patches are deployed.
- Enforce application allowlisting to block untrusted binaries from invoking ProjFS APIs on standard-user workstations.
# Verify and disable the ProjFS optional feature on unaffected workflows
Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS
Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS -NoRestart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
