Windows ProjFS CVE-2025-62462

Requires prior local, authenticated access with the ability to execute code as a low-privileged user (PR:L, AV:L) - this is not remotely reachable. The specific trigger is exercising the Windows Projected File System (ProjFS) code path that mishandles a buffer boundary; ProjFS is the virtualization filesystem feature underpinning tools such as VFS for Git, so hosts where ProjFS is installed/active are in scope. No user interaction is required (UI:N) and complexity is low (AC:L), so once local access is obtained exploitation is straightforward. The primary limiting factor is the local-access prerequisite, which relegates this to post-compromise privilege escalation rather than initial entry.

This is a genuine but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege escalation: an attacker who already has low-privileged code execution on a Windows host can exploit a buffer over-read (CWE-126) in the Windows Projected File System (ProjFS) driver to achieve full CIA impact, consistent with SYSTEM-level elevation. The low attack complexity (AC:L) and no-user-interaction requirement (UI:N) make exploitation reliable once a foothold exists, but the local attack vector (AV:L) and required prior authentication (PR:L) mean this is a second-stage/post-compromise tool rather than an initial access vector. Corroborating signals point to lower real-world urgency: EPSS is 0.40% (32nd percentile), it is NOT on CISA KEV, and no public exploit code has been identified - so no evidence of active or imminent mass exploitation. The classification as a buffer over-read (read, not write) is somewhat unusual for a full-impact EoP; over-reads typically yield info disclosure, so the I:H/A:H likely reflect Microsoft's assessment that the read primitive is chainable to memory corruption or that the driver context enables broader impact - the sparse MSRC advisory (the sole reference) does not detail the mechanism. Net: a legitimate patch-soon local EoP, not a drop-everything emergency.

An attacker who has already gained low-privileged execution on a Windows endpoint (via phishing, a prior RCE, or a malicious local user) invokes the vulnerable ProjFS code path to trigger a buffer over-read in the kernel-mode driver, corrupting or leaking memory to escalate to SYSTEM. No user interaction is needed and attack complexity is low, but local access is a hard prerequisite. No public proof-of-concept has been identified at time of analysis.