CVE-2026-32078
Published: 14 April 2026
Summary
CVE-2026-32078 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the use-after-free vulnerability in Windows Projected File System to prevent local privilege escalation.
Memory protection implements safeguards like DEP and ASLR to block unauthorized code execution from ProjFS use-after-free memory corruption.
Least privilege restricts low-privileged local attackers' access, limiting the impact and scope of privilege escalation via the ProjFS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free memory corruption in ProjFS kernel component directly enables local privilege escalation from low-privileged context to higher permissions (SYSTEM/kernel) via exploitation of the flaw.
NVD Description
Use after free in Windows Projected File System allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-32078 is a use-after-free vulnerability (CWE-416) in the Windows Projected File System (ProjFS), published on 2026-04-14. It affects Windows systems utilizing this component, which enables virtual file systems projected from remote data sources. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A local attacker with low privileges can exploit this use-after-free flaw to elevate privileges on the affected system. Exploitation requires only local access and low attack complexity with no user interaction, allowing the attacker to gain higher-level permissions through memory corruption triggered by improper handling of ProjFS objects after deallocation.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32078 provides details on mitigation, including recommended patches and update guidance for affected Windows versions.
Details
- CWE(s)