Improper access control in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Improper access control (CWE-284) in the Windows Projected File System minifilter prjflt.sys placeholder file write path, local EoP. PrjfOpenFileHandler takes a user-supplied path relative to the virtualization root, resolves it with PrjfRelPathToFullPath and opens it with FltCreateFileEx using a user-supplied DesiredAccess, then stores {FileId, FileObject, FileHandle} in UnionContext->AvlHandleTable. PrjfWriteFileDataHandler later looks the entry up by FileId and calls FltWriteFileEx(Entry->FileObject, Buffer, Length, ByteOffset) with all parameters user-controlled. PRE: the open does not impersonate the calling user, and the virtualization root and its subpaths are writable by ordinary users, so an attacker can pre-plant a directory junction inside the root (e.g. C:\virtRoot\system32 -> C:\Windows\System32) and then open+write C:\virtRoot\system32\arp.exe, which resolves through the junction to C:\Windows\System32\arp.exe - a privileged file the user could not otherwise write. Diff of prjflt.sys 10.0.26100.7920 -> .8036 (Mar 10 2026, KB5079473) confirms the fix: gated behind CFR flag Feature_1083645240, PrjfWriteFileDataHandler now calls a new helper PrjfValidateHandleAccess before writing through the AVL-table FileObject, validating the caller is entitled to the resolved target so junction-redirected writes to privileged files are rejected.

A ProjFS placeholder file is opened without impersonation, so a junction inside the writable root redirects writes to privileged files

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

ChenJian with Sea Security Orca Team