CVE-2025-55233 Overview
CVE-2025-55233 is an out-of-bounds read vulnerability in the Windows Projected File System (ProjFS) that allows an authorized local attacker to elevate privileges. The flaw is tracked under CWE-125 and affects multiple supported Windows client and server releases. Microsoft published the advisory in the Microsoft Security Update Guide on December 9, 2025. Successful exploitation yields high confidentiality, integrity, and availability impact on the affected host.
Critical Impact
A local, authenticated attacker can leverage this out-of-bounds read in ProjFS to escalate privileges and gain full control over the compromised Windows system.
Affected Products
- Microsoft Windows 10 (versions 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, Server 2022, Server 2022 23H2, and Server 2025
- Both x86 and x64 architectures on affected Windows 10 1809 builds
Discovery Timeline
- 2025-12-09 - CVE-2025-55233 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55233
Vulnerability Analysis
The vulnerability lives in the Windows Projected File System, a component that projects hierarchical data into the file system namespace and is used by tools such as Git Virtual File System (GVFS). ProjFS reads structured request data supplied through its callback interfaces and IOCTLs. When it processes a malformed request, it reads beyond the bounds of an allocated buffer. That out-of-bounds read can expose kernel memory contents that inform follow-on primitives, ultimately enabling local privilege elevation. The result is a compromise of confidentiality, integrity, and availability on the local host.
Root Cause
The defect is classified as CWE-125: Out-of-bounds Read. ProjFS fails to correctly validate the size or offset of attacker-influenced input before reading from an internal buffer. Missing bounds checks allow the driver to dereference memory outside the intended allocation.
Attack Vector
Exploitation requires local access and low-privileged authentication on the target host. No user interaction is required. An attacker running code as a standard user issues crafted requests to the ProjFS interface to trigger the out-of-bounds read. The disclosed memory is then chained with additional techniques to escalate to SYSTEM privileges. Microsoft has not reported public exploitation and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score at time of writing is 0.392%.
No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2025-55233
Indicators of Compromise
- Unexpected loading or interaction with the PrjFlt.sys filter driver by non-standard user processes
- Standard user processes spawning elevated child processes such as cmd.exe or powershell.exe running as SYSTEM shortly after ProjFS activity
- Windows Error Reporting entries or bugcheck events involving ProjFS following user-mode API calls
Detection Strategies
- Hunt for user-mode processes calling ProjFS APIs (PrjStartVirtualizing, PrjWritePlaceholderInfo) outside of expected applications like Git or GVFS
- Alert on privilege-escalation patterns where a low-privileged process token is replaced with a SYSTEM token within a short window of ProjFS driver interaction
- Correlate kernel driver events with subsequent process creations that break inheritance from the parent security context
Monitoring Recommendations
- Enable Sysmon Event IDs 1 (process creation) and 10 (process access) and forward to a central data lake for behavioral correlation
- Monitor Windows Security Event ID 4688 for suspicious child processes launched from user-writable directories with elevated integrity levels
- Track patch state across all affected Windows client and server SKUs and prioritize multi-user and terminal-services hosts
How to Mitigate CVE-2025-55233
Immediate Actions Required
- Apply the December 2025 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows 10, Windows 11, and Windows Server systems
- Prioritize patching on multi-tenant and jump hosts where multiple users can execute code locally
- Audit which endpoints have the ProjFS optional feature enabled and validate they are receiving the latest cumulative updates
Patch Information
Microsoft addressed CVE-2025-55233 through the cumulative updates listed in the Microsoft Security Update Guide. The fix strengthens input validation in the Projected File System driver so that request offsets and sizes are checked before memory is read. Administrators should confirm patch deployment through Windows Update, WSUS, or Microsoft Intune reporting.
Workarounds
- Disable the Windows Projected File System optional feature on hosts that do not require GVFS or similar tooling using Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS
- Restrict interactive and remote-desktop logon rights on servers to reduce the population of accounts that can attempt local exploitation
- Enforce application allowlisting to prevent unauthorized binaries from invoking ProjFS APIs until patches are applied
# Verify ProjFS feature state and disable if not required
Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS
Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS -NoRestart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
