CVE-2026-50469 — Windows Projected File System Elevation of Privilege Vulnerability
Executive Summary
Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 1809 for 32-bit Systems | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1809 for x64-based Systems | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for x64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for x64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | 5101649 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 version 26H1 for x64-based Systems | 5095051 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 (Server Core installation) | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022 | 5099540 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5099536 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5099536 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5099538 |
Security Update | Yes |
5099539 |
Security Update | Yes |
5101650 |
Security Update | Yes |
5101649 |
Security Update | Yes |
5095051 |
Security Update | Yes |
5099540 |
Security Update | Yes |
5099536 |
Security Update | Yes |
Patch Diff
Link following (CWE-59) in the Windows Projected File System minifilter prjflt.sys tombstone/reparse-point open path, local EoP (arbitrary file delete -> SYSTEM). ProjFS uses tombstones to mark deleted/virtualized entries; PrjfDeleteTombstoneIfExists opens the tombstone target and removes it. PRE: it opened the target via a reparse-open helper (now renamed PrjfOpenAsReparsePointOld) that followed links, so a local user who planted a symbolic link / junction at the tombstone path could redirect the SYSTEM-context open+delete to an arbitrary target - enabling deletion of files the user could not otherwise delete (per the MSRC FAQ, 'an attacker would be able to delete any system files'), an EoP primitive. Diff of prjflt.sys 10.0.26100.8737 -> .8875 (Jul 14 2026, KB5101650) confirms the fix: gated behind CFR flag Feature_2998397241, PrjfDeleteTombstoneIfExists now calls a new hardened PrjfOpenAsReparsePoint / PrjfOpenReparsePoint (FltCreateFileEx2 with open-reparse-point semantics) that opens the link itself instead of following it, while the original follow-the-link opener is retained as PrjfOpenAsReparsePointOld for the flag-disabled path. Several ProjFS reparse/placeholder functions were recompiled alongside.
| Function | Address | Change | Note |
|---|---|---|---|
PrjfDeleteTombstoneIfExists |
code change |
code (selects non-following reparse open, CFR-gated) | Post (Feature_2998397241): if enabled, calls the new PrjfOpenAsReparsePoint (open-reparse-point, no follow); else PrjfOpenAsReparsePointOld (legacy follow-the-link). |
PrjfOpenAsReparsePoint / PrjfOpenReparsePoint |
new/reworked |
added (non-following reparse open) | New hardened openers using FltCreateFileEx2 with open-reparse-point semantics so the link is opened, not its target. |
PrjfOpenAsReparsePointOld / PrjfOpenReparsePointOld |
retained |
legacy path | The original follow-the-link openers kept for the flag-disabled path. |
Feature_2998397241 |
gate |
added (CFR gate) | CFR flag selecting the non-following reparse open; the original link-following path still ships when disabled. |
Attack Path
A planted link at a ProjFS tombstone path redirects the SYSTEM tombstone delete to an arbitrary file
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.