Windows ProjFS CVE-2025-55233

Requires the attacker to already possess local, authenticated access at standard-user privilege (PR:L, AV:L) on an affected Windows system - this is a local elevation-of-privilege bug, NOT remotely reachable. Exploitation targets the Windows Projected File System (ProjFS) component, which must be present/reachable in the OS; no user interaction is needed (UI:N). Affected platforms span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2019/2022/2022 23H2/2025 per the CPE and tag data. Limiting factors: the attacker needs a prior foothold with code execution as a low-privileged user, and the flaw provides only escalation on an already-compromised host rather than any network-facing entry point.

This is a locally-exploitable elevation-of-privilege vulnerability in the Windows Projected File System (ProjFS), scored 7.8 (High) by Microsoft with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The local attack vector (AV:L) and required low privileges (PR:L) mean an attacker must already have code execution on the host as a standard user, so this is a post-compromise escalation primitive rather than an initial-access flaw. EPSS is low at 0.40% (32nd percentile), and the vulnerability is NOT in CISA KEV with no public exploit identified at time of analysis - signals that are internally consistent and point to no current widespread or automated exploitation. The high CVSS is driven by full C:H/I:H/A:H impact (complete system compromise upon successful escalation) rather than by ease of remote reach. Note a mild tension worth verifying: the CWE-125 out-of-bounds READ and 'Information Disclosure' tag describe a memory-disclosure primitive, yet the outcome is characterized as privilege elevation with I:H/A:H - consistent with an info leak (e.g., defeating kernel ASLR or leaking pointers/tokens) being used as a step within an EoP chain. Overall this is a standard Patch-Tuesday-class EoP: important to patch on a normal cadence, but not an emergency for internet-facing exposure since it cannot be triggered remotely or without an existing foothold.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a separate initial-access bug) invokes the Projected File System (ProjFS) with crafted input that triggers an out-of-bounds read, leaking sensitive kernel memory. Using the disclosed information to bypass memory-protection mitigations, the attacker escalates to SYSTEM-level privileges. No public exploit code has been identified at time of analysis, and exploitation requires prior local access.