Description

Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-11T17:18:27.560Z",
  "pubdate": "2026-08-11T17:18:27.560Z",
  "executiveSummary": "An integer overflow or wraparound vulnerability exists within the Windows Projected File System. This flaw allows an authorized local attacker to achieve privilege escalation on affected systems.\nThe vulnerability affects the Windows Projected File System component of the Microsoft Windows operating system. Successful exploitation enables a low-privileged local user to execute arbitrary code or commands with elevated privileges, severely compromising system integrity and security boundaries.\nExploitation requires the attacker to have local access and prior authorization to interact with the vulnerable system or subsystem. The attack vector does not require network exposure, as it is strictly a local privilege escalation vector.\nThe risk implication is critical due to the potential for complete system compromise if an attacker leverages this privilege escalation flaw in conjunction with other execution primitives. Remediation typically relies on applying official security updates provided by the vendor for the affected component.",
  "technicalDetails": "The vulnerability resides in the Windows Projected File System component, specifically within memory management or arithmetic routines handling size calculations, buffer allocations, or index offsets.\nThe root cause is an integer overflow or wraparound condition. When the subsystem processes specially crafted input or metadata supplied by an attacker, an arithmetic operation exceeds the maximum storable value for the designated integer type. This causes the value to wrap around to a small number or zero.\nSubsequent memory allocation routines rely on this corrupted, wrapped integer value, leading to an allocated buffer that is significantly smaller than required. When data is subsequently written to this undersized buffer, a heap-based or stack-based buffer overflow occurs.\nThe attack flow proceeds as follows: First, the authorized local attacker interacts with the Windows Projected File System via supported APIs or system interfaces. Second, the attacker supplies malformed parameters designed to trigger the integer overflow during internal calculations. Third, the resulting arithmetic wraparound causes insufficient memory allocation. Fourth, the write operation overflows the destination buffer, corrupting adjacent memory structures.\nBy carefully manipulating the memory layout and overflow contents, the attacker can achieve arbitrary read/write primitives or control flow hijacking.\nAuthentication requirements dictate that the attacker must have local execution rights and authorization to interact with the Projected File System. Privilege requirements are low prior to exploitation, but successful execution elevates privileges to those of a higher security context, such as SYSTEM or an administrative user.\nNetwork exposure is non-existent, as the vulnerability cannot be exploited remotely; local access to the target host is strictly required.\nPost-exploitation impact includes full local privilege escalation, persistence mechanisms installation, and bypass of host-based security controls running under standard user contexts."
}