Attack Chain

1. The attacker gains initial access to the target system with valid local user credentials.
2. The attacker executes a specially crafted application designed to interact with the Windows Projected File System.
3. The crafted application triggers the use-after-free vulnerability by causing the Projected File System to access a memory location that has already been freed.
4. This memory corruption allows the attacker to overwrite critical data structures within the kernel.
5. The attacker manipulates these data structures to gain control of system execution flow.
6. The attacker injects malicious code into a privileged process.
7. The injected code executes with elevated privileges (SYSTEM).
8. The attacker can now perform actions such as installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

Impact

Successful exploitation of CVE-2026-32078 allows a local attacker to elevate their privileges to SYSTEM. This grants the attacker complete control over the compromised system. The attacker can install malware, exfiltrate sensitive data, create new administrator accounts, and perform other malicious activities. This could lead to significant data loss, system downtime, and reputational damage. The vulnerability affects all Windows systems that include the Projected File System.

Recommendation

• Apply the security update provided by Microsoft to patch CVE-2026-32078 on all affected Windows systems, as referenced in the vulnerability details.
• Monitor process creations for unusual or unexpected processes spawned by the Projected File System using the provided Sigma rule.
• Implement application control solutions to restrict the execution of unauthorized or untrusted applications that could potentially exploit this vulnerability.