Microsoft Windows Projected File System: Elevation of privilege via use-after-free

Summary

The Windows Projected File System (ProjFS) filter driver contains a use-after-free flaw (CWE-416) that allows a local attacker with a low-privileged account to elevate privileges. Exploitation requires the optional Projected File System feature to be enabled and its filter attached to a volume. Attack complexity is high, and no exploitation in the wild has been found.

Affected

• Windows 10 Version 1809 and Windows Server 2019 (incl. Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711 (platform scope to be confirmed on MSRC)
• Windows 11 Version 24H2 and 25H2: listed as affected in the CVE record, fixed builds to be confirmed on MSRC
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501 (listed as affected on MSRC)
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 (incl. Server Core): 10.0.26100.0 to before 10.0.26100.33822

Fixed in

• Windows 10 1809 / Server 2019: 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846
• Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711 (third-party source, to be verified on MSRC)
• Windows 11 26H1: Unknown.
• Windows Server 2022: 10.0.20348.5870
• Windows Server 2025: 10.0.26100.33822
• Other listed versions: see the Microsoft Security Update Guide, November 2026 updates

Workaround

• Microsoft's advisory states that exploitation requires the optional Projected File System feature to be enabled and its filter attached to a volume.
• Disabling the Client-ProjFS feature on hosts that do not need GVFS or Dev Drive may reduce exposure. This is an inference and not confirmed by Microsoft for this CVE.

Exploitation

• Exploited in the wild: no evidence found.
• Microsoft's temporal vector uses E:U (unproven exploit code maturity).
• Public proof of concept: none found. Unknown beyond that.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Check which hosts have the optional Projected File System feature (Client-ProjFS) enabled.
• Install the Microsoft November 2026 security updates on all affected builds, prioritising developer workstations, build servers, multi-user systems and terminal servers.
• Check the patch status of Windows 10 1809 and 21H2 systems, as they may be out of standard support.
• Confirm the Windows 11 23H2 platform scope and the Windows 11 26H1 fixed build on the MSRC page.
• Where the feature is not needed, consider disabling it as an additional measure.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-108414 msrc.microsoft.com
• CVE Record: CVE-2026-108414 www.cve.org
• OffSeq Radar: CVE-2026-108414 radar.offseq.com
• Strix AI: CVE-2026-108414 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:28.