# CVE-2026-24290 — Windows Projected File System `prjflt.sys` Placeholder Write Without Impersonation in `PrjfWriteFileDataHandler` → Junction-Redirected Arbitrary Write

---

## Summary

| | |
|---|---|
| **Product** | Windows — `prjflt.sys` (Windows Projected File System / ProjFS minifilter; placeholder file write) |
| **CVE ID** | CVE-2026-24290 |
| **Impact** | Elevation of Privilege |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-284: Improper Access Control |
| **Delivery** | Local — ProjFS open+write of a relative path through a pre-planted junction |
| **KB / Fixed build** | KB5079473 — `prjflt.sys` 10.0.26100.8036 (Win11 24H2 x64) |
| **Patch Date** | March 10, 2026 (2026-Mar) |
| **Pre-patch binary** | `prjflt.sys` 10.0.26100.7920 — SHA256 `e31bf9ae1bdff86e6683e469dd56d341c019c02e389d3086608ba61de160949f` |
| **Post-patch binary** | `prjflt.sys` 10.0.26100.8036 — SHA256 `d5afe5fe1f66c520b1b49bf43d8567d80c4dd42a03621cbceb6587bc29a424dc` |
| **Feature flag** | `Feature_1083645240` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`PrjfOpenFileHandler` opens a file inside a ProjFS virtualization root. It takes a
user-supplied path **relative to the virtualization root**, resolves it to a full
path with `PrjfRelPathToFullPath`, and opens it with `FltCreateFileEx` using a
user-supplied `DesiredAccess`. It then records the result in a per-context AVL
handle table:

```c
struct _PRJ_HANDLE_AVL_TABLE_ENTRY { UUID FileId; PFILE_OBJECT FileObject; HANDLE FileHandle; };
```

`PrjfWriteFileDataHandler` later looks the entry up by `FileId` and writes to it:

```c
FltWriteFileEx(..., Entry->FileObject, /*Buffer,Length,ByteOffset all user-controlled*/ ...);
```

---

## Vulnerability Summary

The virtualization root and its subpaths are writable by ordinary users, and the
open in `PrjfOpenFileHandler` **does not impersonate the calling user** — `prjflt`
opens the resolved path in its own (kernel/SYSTEM) context. An attacker can
therefore pre-plant a directory junction inside the root and redirect the open to a
privileged location:

> Root = `C:\virtRoot`; attacker creates junction `C:\virtRoot\system32` →
> `C:\Windows\System32`. Opening `C:\virtRoot\system32\arp.exe` and writing to it
> via `PrjfWriteFileDataHandler` is equivalent to writing
> `C:\Windows\System32\arp.exe`.

Because the file is opened without impersonation and without re-validating the
caller's entitlement to the resolved target, a low-privileged user gains an
arbitrary write to files they could not otherwise modify (CWE-284) — a local EoP
primitive.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): drive `PrjfOpenFileHandler` /
  `PrjfWriteFileDataHandler` on a ProjFS virtualization instance.
- Pre-plant a junction inside the writable root pointing at a privileged directory.
- Result: open+write of a relative path resolves through the junction to a
  privileged file.

---

## Vulnerability Details

### Root Cause

The placeholder open/write path acted with the driver's own privileges and did not
re-check that the caller was entitled to the resolved target, so a junction inside
the user-writable root redirected privileged writes.

### The patch (confirmed — diff, .7920 → .8036)

Gated behind `Feature_1083645240`, `PrjfWriteFileDataHandler` now calls a **new
helper `PrjfValidateHandleAccess`** before writing through the AVL-table
`FileObject`, validating that the caller is entitled to the resolved target so a
junction-redirected write to a privileged file is rejected:

```c
// PrjfWriteFileDataHandler (10.0.26100.8036) — PATCHED, feature-enabled branch (from our diff)
if (Feature_1083645240__private_IsEnabledDeviceUsageNoInline()) {
    status = PrjfValidateHandleAccess(...);   // new: verify caller entitlement to the target
    if (status < 0) return status;            // reject junction-redirected privileged writes
}
... FltWriteFileEx(Entry->FileObject, ...);
```

(`PrjfValidateHandleAccess` is newly added to the driver and to
`PrjfWriteFileDataHandler`'s call graph in the patched build.)

### Patch Completeness Assessment

**CFR-gated behind `Feature_1083645240`.** The access validation runs only when the
flag is enabled; the original unchecked write path still ships when disabled.
Verify `Feature_1083645240` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** ProjFS placeholder writes whose resolved target lies outside the
virtualization root (junction/reparse traversal), especially into system
directories; `prjflt!PrjfWriteFileDataHandler` → `FltWriteFileEx` writes to
protected files on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_1083645240` is enabled.

---

## References

- MSRC advisory — CVE-2026-24290 (Windows Projected File System Elevation of Privilege), released 2026-03-10, KB5079473.
- Full binary diff: `/data/patch_diffs/prjflt_sys-cve-2026-24290-ghidriff.md`
- Related same-KB ProjFS fix: CVE-2026-24287.