CVE-2025-62461: Windows 10 1809 Privilege Escalation Flaw

CVE-2025-62461 is a privilege escalation vulnerability in Windows 10 1809 Projected File System Filter Driver. Attackers with local access can exploit a buffer over-read to gain elevated privileges. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-62461 Overview

CVE-2025-62461 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS) Filter Driver. An authenticated local attacker can exploit the flaw to elevate privileges on affected Windows client and server systems. The issue is tracked under CWE-126: Buffer Over-read and affects a broad range of supported Windows versions, from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019 through Windows Server 2025. Microsoft published the vulnerability on December 9, 2025 as part of its security update guidance.

Critical Impact
A local, authorized attacker can read out-of-bounds kernel memory through the ProjFS filter driver to escalate to higher privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2)
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-12-09 - CVE-2025-62461 published to NVD
2025-12-09 - Microsoft releases security update guidance
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62461

Vulnerability Analysis

The vulnerability resides in the Windows Projected File System Filter Driver (PrjFlt.sys), a kernel-mode component that projects virtualized directory hierarchies into the file system namespace. ProjFS is used by tools such as Git Virtual File System (GVFS) to expose remote or synthetic content as local files.

A buffer over-read [CWE-126] occurs when the driver reads data past the intended end of a buffer. In kernel context, this can leak sensitive memory contents (pointers, tokens, or structures) into user-controlled paths. An attacker with local, low-privileged access can craft input to the ProjFS interface that triggers the over-read and use the disclosed data to bypass mitigations such as Kernel Address Space Layout Randomization (KASLR) and complete a local elevation of privilege chain.

Root Cause

The defect stems from improper bounds validation in a ProjFS driver code path that processes attacker-supplied buffers or offsets. The driver reads beyond the allocated buffer length, returning adjacent kernel memory to the caller. Microsoft has not released public exploitation details.

Attack Vector

Exploitation requires local access and valid credentials on the target host. No user interaction is required. An attacker running code as a standard user issues crafted requests to the ProjFS filter driver, then leverages the leaked kernel data to complete privilege escalation to SYSTEM. See the Microsoft CVE-2025-62461 Update Guide for vendor detail.

// No public proof-of-concept is available for CVE-2025-62461.
// Refer to the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2025-62461

Indicators of Compromise

No public indicators of compromise have been released for CVE-2025-62461.
Unexpected loading or interaction with PrjFlt.sys from non-standard user processes may warrant review.
Standard user accounts spawning processes that transition to SYSTEM without a known service pathway.

Detection Strategies

Alert on anomalous handle opens to \\.\PrjFlt or ProjFS control device objects from unprivileged processes.
Monitor for post-exploitation behavior consistent with local privilege escalation, including token manipulation and parent-child process anomalies.
Correlate kernel driver interaction telemetry with subsequent SYSTEM-level process creation events.

Monitoring Recommendations

Enable Windows Defender ASR rules and audit-mode logging for suspicious kernel driver interactions.
Ingest Sysmon and EDR telemetry (process creation, image load, driver load) into a centralized SIEM for correlation.
Track patch compliance for the December 2025 Windows security updates across all endpoints and servers.

How to Mitigate CVE-2025-62461

Immediate Actions Required

Apply the Microsoft December 2025 security updates for all supported Windows client and server SKUs listed in the advisory.
Prioritize patching multi-user hosts, developer workstations, and any system with ProjFS-dependent tooling such as GVFS.
Restrict local logon rights and enforce least privilege to reduce the pool of accounts that can trigger local exploitation.

Patch Information

Microsoft has released fixes through the standard Windows Update channels. Consult the Microsoft CVE-2025-62461 Update Guide for KB article numbers and build-specific package identifiers for each affected Windows and Windows Server version.

Workarounds

No official workaround is documented by Microsoft; patching is the supported remediation.
Where patching is delayed, disable the Projected File System optional feature on hosts that do not require it.
Limit interactive and remote logon to trusted administrators to reduce local attack surface.

bash

# Disable the Projected File System optional feature (PowerShell, elevated)
Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS -NoRestart

# Verify current state of the ProjFS feature
Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS