cve-2026-42837

CVE-2026-42837 is a Windows Projected File System (ProjFS) elevation-of-privilege vulnerability disclosed by Microsoft on June 9, 2026. Rated Important severity, it stems from a buffer over-read in the ProjFS filter driver and requires local access with low privileges. Microsoft released fixes for supported Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 builds. At publication, no known exploitation was reported. This tag covers discussion of the vulnerability details, affected systems, and the broader pattern of local privilege-escalation bugs in Windows file-system components.