Attack Chain

1. Attacker gains initial access to the target Windows system with a standard user account.
2. Attacker crafts a malicious application designed to interact with the Projected File System.
3. The malicious application triggers a specific sequence of ProjFS API calls to manipulate file system projections.
4. The crafted API calls cause ProjFS to free a memory location twice.
5. The double free corrupts the heap, potentially allowing the attacker to overwrite critical data structures.
6. The attacker leverages the heap corruption to overwrite security tokens or other privilege-related data within the Windows kernel.
7. The attacker executes code that assumes the identity of a privileged user or system process.
8. Attacker successfully elevates their privileges and gains elevated access to the system.

Impact

Successful exploitation of CVE-2026-32074 allows a local attacker to elevate their privileges on a vulnerable Windows system. This could lead to complete system compromise, including the ability to install programs, view, change, or delete data, or create new accounts with full user rights. The impact is significant as it bypasses standard access controls and allows an attacker to perform any action on the system. While the number of affected systems isn't specified, any Windows system running the vulnerable version of ProjFS is susceptible to this attack.

Recommendation

• Apply the security update provided by Microsoft for CVE-2026-32074 as detailed in the Microsoft Security Response Center advisory to patch the double-free vulnerability in ProjFS.
• Enable and review process creation logs for unusual processes spawned by applications interacting with the Projected File System, which might indicate exploitation attempts (logsource: process_creation).
• Implement application control policies to restrict the execution of untrusted or unsigned applications that may attempt to exploit this vulnerability.