CVE-2025-62467: Windows 10 1809 Privilege Escalation Flaw

CVE-2025-62467 Overview

CVE-2025-62467 is an integer overflow vulnerability in the Windows Projected File System (ProjFS) that allows an authenticated local attacker to elevate privileges. The flaw affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2019 through Windows Server 2025. Microsoft classifies the issue as an elevation of privilege vulnerability tied to CWE-126: Buffer Over-read, which in this context stems from integer wraparound during buffer size calculations. Successful exploitation grants SYSTEM-level code execution on the target host.

Critical Impact
An authorized local attacker can trigger an integer overflow in ProjFS to escalate privileges and gain full control over confidentiality, integrity, and availability of the affected Windows system.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2)
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-12-09 - CVE-2025-62467 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62467

Vulnerability Analysis

The Windows Projected File System (ProjFS) is a Microsoft-provided kernel-mode component that lets applications project hierarchical data, such as a remote source tree or virtual repository, into the local file system namespace. Git Virtual File System (GVFS) is a well-known consumer of ProjFS.

CVE-2025-62467 is an integer overflow or wraparound flaw inside ProjFS. When the component performs arithmetic on attacker-influenced size or offset values, the calculation wraps around, producing an undersized allocation or an incorrect bounds check. Subsequent memory operations then read or write outside the intended buffer, corrupting adjacent kernel structures or leaking sensitive kernel memory contents.

Exploitation requires local access and low privileges. No user interaction is needed. An attacker who already has a foothold as a standard user can leverage the flaw to execute code in the kernel context, which yields SYSTEM privileges.

Root Cause

The root cause is unsafe arithmetic on size or length fields within ProjFS request handling. When these values overflow their integer type, the resulting truncated value is used for buffer allocation or boundary validation. This produces the buffer over-read condition tracked as CWE-126 and enables out-of-bounds memory access under attacker control.

Attack Vector

The attack vector is local. An authenticated user issues crafted requests to the ProjFS driver, typically through its documented I/O interfaces used by virtualization providers. The malformed inputs trigger the overflow, corrupt kernel memory, and pivot the attacker's process context to SYSTEM. Microsoft has not reported active exploitation, and no public proof of concept is available at time of writing. Refer to the Microsoft CVE-2025-62467 Update Guide for authoritative technical details.

Detection Methods for CVE-2025-62467

Indicators of Compromise

Unexpected loading or interaction with the PrjFlt.sys ProjFS filter driver from non-standard user processes.
Standard user processes that suddenly spawn child processes running as NT AUTHORITY\SYSTEM.
Windows kernel bugcheck events or Event ID 41 crashes correlated with ProjFS activity.
Creation of unexpected virtualization root directories via the PrjStartVirtualizing API by non-GVFS or non-development applications.

Detection Strategies

Monitor for token duplication and impersonation events (Sysmon Event ID 1, Windows Event ID 4672) originating from low-privilege user sessions.
Baseline legitimate ProjFS consumers such as Git VFS and alert on new processes issuing ProjFS I/O control codes.
Correlate kernel crash telemetry with recent ProjFS driver interactions to surface exploitation attempts that fail before achieving code execution.

Monitoring Recommendations

Enable kernel-mode driver telemetry and forward ProjFS filter driver events to centralized logging.
Track privilege escalation sequences where a non-administrative process obtains a SYSTEM token within a short time window.
Review endpoint detection alerts for anomalous IOCTL traffic to \Device\PrjFlt and related ProjFS device objects.

How to Mitigate CVE-2025-62467

Immediate Actions Required

Apply the Microsoft security update referenced in the CVE-2025-62467 Update Guide to every affected Windows client and server build.
Prioritize patching on multi-user systems, terminal servers, and developer workstations where local user access is broad.
Audit which endpoints have the ProjFS optional feature enabled and confirm patch state on those systems first.

Patch Information

Microsoft addressed CVE-2025-62467 in the December 2025 security updates. The fix is delivered through the standard Windows cumulative update channel for all listed Windows 10, Windows 11, and Windows Server versions. Consult the Microsoft Security Response Center advisory for the specific KB article and build numbers for each supported release.

Workarounds

Disable the Windows Projected File System optional feature on hosts where it is not required by developer tooling or virtualization providers.
Restrict interactive and remote local logon rights so that only trusted administrators can execute code on sensitive servers until patches are deployed.
Enforce least-privilege policies and application allowlisting to reduce the population of local users who could reach the vulnerable driver.

bash

# Check whether the Projected File System optional feature is enabled
DISM /Online /Get-FeatureInfo /FeatureName:Client-ProjFS

# Disable ProjFS on hosts that do not require it (requires reboot)
DISM /Online /Disable-Feature /FeatureName:Client-ProjFS /NoRestart