CVE-2025-62462 Overview
CVE-2025-62462 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS). The flaw allows an authorized local attacker to elevate privileges on affected Windows client and server systems. Microsoft assigned this issue a CVSS 3.1 score of 7.8 and categorized it under CWE-126: Buffer Over-read. Exploitation requires local access and low privileges but no user interaction. Successful exploitation compromises the confidentiality, integrity, and availability of the affected host.
Critical Impact
A local, authorized attacker can leverage a buffer over-read in ProjFS to escalate to higher privileges on Windows 10, Windows 11, and Windows Server systems.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-62462 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62462
Vulnerability Analysis
The vulnerability resides in the Windows Projected File System (ProjFS), a component that lets user-mode providers project virtual files and directories into the file system namespace. ProjFS is used by tooling such as GVFS and Git virtual file systems to represent remote content as local files on demand.
A buffer over-read [CWE-126] occurs when code reads past the end of a valid buffer. In this case, malformed input passed to ProjFS causes it to read memory beyond the intended bounds of a kernel or system buffer. That out-of-bounds memory can then influence privileged code paths, enabling local privilege escalation to SYSTEM.
Root Cause
The root cause is improper bounds checking on data processed by the Projected File System. When the component parses a length or offset field controlled by the caller, it dereferences memory outside the allocated region. This weakness is classified under CWE-126: Buffer Over-read.
Attack Vector
An attacker must already have a foothold on the target host as an authenticated low-privilege user. The attacker then interacts with the ProjFS interface using crafted requests that trigger the over-read. Because the flaw executes in a privileged context, a successful exploit yields elevated rights, allowing the attacker to install programs, modify data, or create new accounts. Public exploit code is not currently available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified public proof-of-concept has been released. See the Microsoft CVE-2025-62462 Update Guide for vendor technical details.
Detection Methods for CVE-2025-62462
Indicators of Compromise
- Unexpected loading or interaction with the ProjFS driver (PrjFlt.sys) by non-standard user processes.
- Sudden token or integrity level changes on processes spawned by low-privilege users.
- Crash reports or Windows Error Reporting entries referencing ProjFS components on hosts where ProjFS is not actively used.
Detection Strategies
- Monitor for enablement of the Client-ProjFS Windows optional feature on endpoints that do not require Git virtual file systems.
- Alert on process creation chains where a standard user context transitions to SYSTEM without a corresponding legitimate service invocation.
- Correlate ProjFS API usage from unsigned or newly observed binaries against a baseline of known ProjFS providers.
Monitoring Recommendations
- Enable kernel-mode driver load auditing and forward events to a central SIEM for correlation.
- Track integrity level changes and privilege assignment events (Windows Event IDs 4672, 4673, 4688).
- Baseline expected ProjFS providers and flag deviations from that inventory.
How to Mitigate CVE-2025-62462
Immediate Actions Required
- Apply the December 2025 Microsoft security updates referenced in the Microsoft CVE-2025-62462 Update Guide to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching on multi-user hosts such as Remote Desktop Session Hosts and developer workstations where low-privilege users are common.
- Audit local account privileges and remove unnecessary interactive logon rights.
Patch Information
Microsoft has released cumulative updates that address CVE-2025-62462 across all supported Windows client and server SKUs listed above. Administrators should deploy the fixes through Windows Update, WSUS, Microsoft Update Catalog, or their standard patch management tooling. Consult the Microsoft Security Response Center advisory for the specific KB article numbers per operating system version.
Workarounds
- If ProjFS is not required, disable the Client-ProjFS Windows optional feature using Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS.
- Restrict access to systems that must run ProjFS to trusted, patched users only.
- Enforce application allowlisting to prevent execution of untrusted binaries that could trigger the ProjFS code path.
# Disable the Projected File System optional feature on hosts that do not require it
Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS -NoRestart
# Verify the feature state after reboot
Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
