CVE-2025-62464 Overview
CVE-2025-62464 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS). The flaw allows an authorized local attacker to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on December 9, 2025, covering Windows 10, Windows 11, and Windows Server editions from 2019 through 2025.
The vulnerability is tracked as CWE-126: Buffer Over-read. Successful exploitation grants high impact to confidentiality, integrity, and availability of the target system.
Critical Impact
A local, authenticated attacker can read out-of-bounds memory in ProjFS to escalate to SYSTEM-level privileges on unpatched Windows hosts.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-62464 published to NVD and Microsoft advisory released
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62464
Vulnerability Analysis
The Windows Projected File System (ProjFS) provides a virtualization layer that allows applications, notably Git Virtual File System (GVFS), to expose data as files and directories on demand. The service runs with kernel or highly privileged user-mode components and processes structured requests from userland callers.
CVE-2025-62464 is a buffer over-read [CWE-126] in ProjFS. The component reads memory past the intended bounds of a buffer during request handling. That leaked memory can expose privileged pointers, tokens, or structures that the attacker uses to elevate privileges.
Because the attack vector is local and requires low privileges with no user interaction, any authenticated user, including standard accounts and service identities, can invoke ProjFS APIs on the target host. The confidentiality, integrity, and availability impacts are all rated high, consistent with a local elevation to SYSTEM.
Root Cause
The root cause is missing or incorrect length validation when ProjFS parses input structures. When the driver copies or interprets data past the allocated buffer boundary, it exposes adjacent kernel or process memory. Attackers use the leaked bytes to defeat mitigations such as Kernel Address Space Layout Randomization (KASLR) or to reconstruct security tokens.
Attack Vector
Exploitation is local. An attacker with a valid Windows account interacts with the ProjFS driver through documented or reverse-engineered IOCTLs and virtualization callbacks. By crafting malformed metadata or oversized field descriptors, the attacker triggers the over-read and captures leaked bytes back into user mode. The leaked material is then chained with a secondary primitive to complete the privilege escalation.
No public proof-of-concept or exploit code has been observed at the time of writing. Refer to the Microsoft Security Update CVE-2025-62464 advisory for authoritative technical details.
Detection Methods for CVE-2025-62464
Indicators of Compromise
- Unexpected loading or interaction with the PrjFlt.sys filter driver by non-developer, non-Git processes.
- Standard user accounts spawning processes that later run as NT AUTHORITY\SYSTEM without an established service parent.
- New scheduled tasks, services, or local accounts created shortly after ProjFS API activity from a low-privileged session.
Detection Strategies
- Hunt for anomalous callers of ProjFS APIs such as PrjStartVirtualizing and related IOCTLs from processes outside GVFS or approved developer tooling.
- Correlate token elevation events (Windows Event ID 4672) with the parent process lineage of the invoking user session.
- Use behavioral endpoint detection to flag local privilege escalation chains that follow ProjFS interaction.
Monitoring Recommendations
- Enable and forward Sysmon process creation, image load, and driver load events into a centralized SIEM.
- Monitor kernel driver load telemetry for PrjFlt.sys on systems that do not use GVFS or Windows Dev Drive features.
- Alert on standard user processes obtaining SeDebugPrivilege or SeTcbPrivilege outside change windows.
How to Mitigate CVE-2025-62464
Immediate Actions Required
- Apply the December 2025 Microsoft security updates referenced in the Microsoft Security Update CVE-2025-62464 advisory to all affected Windows 10, Windows 11, and Windows Server systems.
- Inventory hosts where the Projected File System optional feature is enabled and prioritize them for patching.
- Restrict interactive and remote logon rights on servers to reduce the population of accounts able to reach local attack surfaces.
Patch Information
Microsoft addressed CVE-2025-62464 through cumulative updates for the affected Windows releases. Consult the Microsoft Security Update Guide for the exact KB article, build numbers, and servicing channel matching each product version.
Workarounds
- Disable the Windows Projected File System optional feature on systems that do not require GVFS, Dev Drive, or virtualized file providers.
- Enforce least privilege so that standard users cannot execute untrusted binaries on servers and shared workstations.
- Apply application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block unapproved local tooling.
# Disable the Windows Projected File System optional feature (PowerShell, elevated)
Disable-WindowsOptionalFeature -Online -FeatureName Client-ProjFS -NoRestart
# Verify the feature state after reboot
Get-WindowsOptionalFeature -Online -FeatureName Client-ProjFS
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
