Brief Summary: CVE-2026-34340 Use After Free in Windows Projected File System Enables Local Privilege Escalation

Introduction

A use after free in the Windows Projected File System (ProjFS) shipped with every supported version of Windows and gives any local user with basic credentials a path to SYSTEM privileges. Microsoft patched CVE-2026-34340 on May 12, 2026 in its regular Patch Tuesday cycle. Exploitation requires winning a race condition, but the payoff is full host compromise, which makes this one worth tracking for any team that manages Windows endpoints or servers.

Technical Information

Root Cause: Use After Free in ProjFS Object Lifetime Management

CVE-2026-34340 is classified under CWE-416 (Use After Free). The flaw is in the Windows Projected File System, a virtualization layer that lets a user-mode application (called a "provider") project hierarchical data from a backing data store into the file system, where it appears as native files and directories. VFS for Git and other applications that need to lazily materialize large directory trees use ProjFS.

ProjFS runs as a kernel-mode component, so the use after free involves kernel object lifetime management. The race condition window indicates that concurrent operations on ProjFS-managed objects can reach a state where one code path frees an object while another keeps a stale pointer to it and later dereferences it. Winning this race gives the attacker control over the contents of the reallocated memory region. In a kernel context, that translates directly to arbitrary code execution at the highest privilege level.

CVSS Breakdown

The full CVSS 3.1 vector string is:

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Key observations from the vector:

• Attack Vector (AV:L): The attacker must have local access to the target system. The flaw is not remotely exploitable.
• Attack Complexity (AC:H): Exploitation requires winning a race condition, which is nontrivial and may take repeated attempts or precise timing.
• Privileges Required (PR:L): A low-privilege account is enough. The attacker needs no administrative access to start the attack.
• User Interaction (UI:N): The victim does not need to do anything.
• Impact (C:H/I:H/A:H): If the attacker wins the race, they get SYSTEM-level access and total compromise of confidentiality, integrity, and availability on the host.
• Exploit Code Maturity (E:U): No public exploit code existed at the time of disclosure.

Attack Flow

Based on the available details, exploitation would proceed as follows:

1. The attacker authenticates to the target system with a low-privilege account.
2. The attacker triggers concurrent ProjFS operations designed to create a race condition around object deallocation and subsequent access.
3. If the attacker wins the race, the kernel dereferences a freed object while the attacker controls the contents of the memory reallocated at that address.
4. The attacker uses the corrupted kernel state to execute code in kernel mode and escalate privileges to SYSTEM.

The scope is unchanged (S:U), so the violated security boundary is within the same security authority (the local OS). The impact is still total host compromise.

Patch Information

Microsoft released an official fix for CVE-2026-34340 on May 12, 2026 in its regular Patch Tuesday security updates. The Remediation Level is classified as "Official Fix," meaning a complete vendor solution has shipped. The patch corrects how ProjFS manages object lifetimes and closes the race condition window that could be exploited to reference freed memory. This is a closed-source Windows kernel-mode component, so no source-level diff is publicly available. The fix is delivered only through cumulative updates.

Microsoft has not published a workaround for this vulnerability. Patching is the only remediation.

The fix ships for the following products:

For Server 2022, Server 2025, and Windows 11 24H2/25H2, Microsoft also provides Security Hotpatch Updates under the separate KB numbers listed above. These hotpatch KBs apply the fix without an immediate reboot, which is particularly useful in production server environments.

Every listed product entry carries the "Customer Action Required" flag. In managed environments, automatic updates alone may not be enough. Administrators should verify deployment through Windows Update, WSUS, or the Microsoft Update Catalog.

Affected Systems and Versions

The following Windows versions are confirmed vulnerable prior to the patched builds listed above:

• Windows 10 Version 22H2 (builds prior to 10.0.19045.7291)
• Windows 10 Version 21H2 (builds prior to 10.0.19044.7291)
• Windows 10 Version 1809 (builds prior to 10.0.17763.8755)
• Windows 11 Version 26H1 (builds prior to 10.0.28000.2113)
• Windows 11 Version 25H2 (builds prior to 10.0.26200.8457)
• Windows 11 Version 24H2 (builds prior to 10.0.26100.8457)
• Windows 11 Version 23H2 (builds prior to 10.0.22631.7079)
• Windows Server 2025 (builds prior to 10.0.26100.32860)
• Windows Server 2022 (builds prior to 10.0.20348.5139)
• Windows Server 2022, 23H2 (builds prior to 10.0.25398.2330)
• Windows Server 2019 (builds prior to 10.0.17763.8755)

The vulnerable component is the Windows Projected File System, which is available as an optional feature on these platforms.

Vendor Security History

Microsoft addressed 137 vulnerabilities in the May 2026 Patch Tuesday cycle, alongside 137 Chromium-related issues for Microsoft Edge. No zero-day vulnerabilities were reported in this patch cycle. That is relatively uncommon, and it suggests a period of lower threat actor activity against newly disclosed Microsoft flaws. Researcher ChenJian of the Sea Security Orca Team responsibly disclosed CVE-2026-34340.

References

• CVE-2026-34340: MSRC Security Update Guide
• CVE Record: CVE-2026-34340 (CVE.org)
• NVD Entry: CVE-2026-34340
• CWE-416: Use After Free
• Windows Projected File System Documentation (Microsoft Learn)
• Microsoft May 2026 Patch Tuesday (SANS Internet Storm Center)
• Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days (BleepingComputer)
• Zero Day Initiative: The May 2026 Security Update Review
• Desktop Windows Version Market Share Worldwide (StatCounter)
• Microsoft Update Catalog