# CVE-2026-50469 — Windows Projected File System `prjflt.sys` Link Following in `PrjfDeleteTombstoneIfExists` → Arbitrary File Delete

---

## Summary

| | |
|---|---|
| **Product** | Windows — `prjflt.sys` (Windows Projected File System / ProjFS minifilter; tombstones) |
| **CVE ID** | CVE-2026-50469 |
| **Impact** | Elevation of Privilege (arbitrary file delete → SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-59: Improper Link Resolution Before File Access (Link Following) |
| **Delivery** | Local — a planted link/junction at a ProjFS tombstone path |
| **KB / Fixed build** | KB5101650 — `prjflt.sys` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `prjflt.sys` 10.0.26100.8737 — SHA256 `8d985c0ae5a872bb2691141fc0552b6f1ec4fd7de71bc641726f22073360a99c` |
| **Post-patch binary** | `prjflt.sys` 10.0.26100.8875 — SHA256 `900cf86fac329554e9142d7824d2fd758e119c9d2b9c8c7bc549bfc5873b57ef` |
| **Feature flag** | `Feature_2998397241` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Unlikely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`prjflt.sys` is the Windows Projected File System (ProjFS) minifilter. ProjFS uses
**tombstones** to mark entries that have been deleted or are virtualized away.
`PrjfDeleteTombstoneIfExists` opens the tombstone target and removes it, running in
the filter's (SYSTEM) context.

---

## Vulnerability Summary

Pre-patch, `PrjfDeleteTombstoneIfExists` opened the tombstone target with a
reparse-open helper (now renamed `PrjfOpenAsReparsePointOld`) that **followed
links**. A local user could plant a symbolic link / junction at the tombstone path
so that the SYSTEM-context open-and-delete resolved through the link to an
**attacker-chosen target**, allowing deletion of files the user could not otherwise
delete (link following, CWE-59). Per the MSRC FAQ, an attacker "would be able to
delete any system files" — an arbitrary-delete primitive that is readily converted
to elevation of privilege.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): drive ProjFS so a tombstone delete
  occurs on a path the attacker controls.
- Plant a symbolic link / junction at the tombstone path pointing at the target
  file.
- Result: the SYSTEM-context open+delete follows the link and deletes the target.

---

## Vulnerability Details

### Root Cause

The tombstone target was opened with a reparse open that resolved (followed) a link
at the path before deletion, so a planted link redirected the privileged delete to
an arbitrary file.

### The patch (confirmed — diff, .8737 → .8875)

Gated behind `Feature_2998397241`, `PrjfDeleteTombstoneIfExists` now opens the
tombstone via a **new hardened opener that does not follow the link** — it opens the
reparse point itself (`FltCreateFileEx2` with open-reparse-point semantics) — while
the original follow-the-link opener is retained as `PrjfOpenAsReparsePointOld` for
the flag-disabled path:

```c
// PrjfDeleteTombstoneIfExists (10.0.26100.8875) — PATCHED (from our diff)
if (Feature_2998397241__private_IsEnabledDeviceUsageNoInline()) {
    uVar6 = PrjfOpenAsReparsePoint(...);      // NEW: open the reparse point, do not follow
} else {
    uVar6 = PrjfOpenAsReparsePointOld(...);   // legacy: follow-the-link (vulnerable)
}
```

The new `PrjfOpenAsReparsePoint` / `PrjfOpenReparsePoint` open the link itself
instead of its target, so a planted symlink/junction can no longer redirect the
SYSTEM tombstone-delete, closing the arbitrary-file-delete.

### Patch Completeness Assessment

**CFR-gated behind `Feature_2998397241`.** The non-following open runs only when the
flag is enabled; the original follow-the-link path (`*Old`) still ships when
disabled. Verify `Feature_2998397241` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Symbolic links / junctions planted at ProjFS tombstone paths;
SYSTEM-context file deletes from `prjflt!PrjfDeleteTombstoneIfExists` resolving
outside the virtualization root on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_2998397241` is enabled.

---

## References

- MSRC advisory — CVE-2026-50469 (Windows Projected File System Elevation of Privilege), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/prjflt_sys-cve-2026-50469-ghidriff.md`