Windows ProjFS CVE-2025-62461

Requires the attacker to already possess local, authenticated low-privileged code execution on the target Windows system (AV:L, PR:L) - this is a post-compromise elevation, not a remote entry point. The vulnerable component is the Windows Projected File System (ProjFS / prjflt.sys) filter driver; exploitation reaches it through local interaction with the driver and requires no user interaction (UI:N) and no special complexity (AC:L). Limiting factors: no remote vector, a valid local foothold is mandatory, and reaching the ProjFS code path may depend on the Projected File System / VFS-for-Git optional feature being present or invoked, though the driver ships with all supported Windows 10, Windows 11, and Windows Server builds. No public exploit exists, raising the practical bar to custom exploit development.

Signals converge on a moderate, patch-on-cycle priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a classic local privilege-escalation: the attacker must already have code execution as a low-privileged user on the box (AV:L, PR:L), but once there, exploitation is low-complexity, needs no user interaction, and yields full confidentiality, integrity and availability impact - consistent with corrupting or reading kernel memory via the ProjFS filter driver (prjflt.sys). EPSS is low at 0.40% (32nd percentile), the CVE is NOT on CISA KEV, and no public exploit was identified, so all exploitation-likelihood signals agree this is not currently under mass exploitation. There is no signal conflict: the low EPSS is consistent with a local-only EOP that lacks public PoC. The main caveat is that the MSRC advisory is the sole source and provides no root-cause or triggering detail, so the exact affected code path and whether the over-read enables reliable control-flow hijack (vs. info leak only) cannot be verified from available data. Net: a genuine but not urgent EOP - a useful post-compromise link in a chain, deploy in normal Patch Tuesday cadence.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard-user account) invokes the Projected File System filter driver through crafted input that triggers an out-of-bounds read in kernel memory. By leveraging the buffer over-read, the attacker leaks sensitive kernel data or corrupts state to elevate to SYSTEM. No public exploit code was identified at time of analysis, so a working exploit would need to be developed.