CVE-2026-32078

CVE-2026-32078 is a use-after-free vulnerability in Windows Projected File System that enables an authorized local attacker to achieve privilege escalation on affected systems. This memory safety issue poses a significant risk to Windows environments where multiple users have local access. The vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector, low complexity, and low privilege requirements. Successful exploitation results in high impact across confidentiality, integrity, and availability, potentially allowing an attacker to gain elevated system privileges and compromise system security. Current exploitation status indicates this vulnerability is not being actively exploited in the wild, with no public exploit code available and no inclusion on the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00049 places it below the median for all CVEs, suggesting lower real-world exploitation probability at this time. However, the FAUCET risk score of 39.0 indicates moderate organizational concern warranting timely patching.