Windows ProjFS CVE-2025-62464

Requires the attacker to already possess authenticated local access with the ability to execute code as a low-privileged user on the target (AV:L, PR:L, UI:N); there is no remote or network-facing exploitation path. Exploitation targets the Windows Projected File System (ProjFS) subsystem, which is present across supported Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, and per tags 2025) SKUs. No special non-default configuration is described in Microsoft's advisory; ProjFS is a standard OS component, though the affected functionality must be reachable by the attacker's process. The primary limiting factor is the mandatory pre-existing local foothold - this is a privilege-escalation building block, not a standalone entry point.

This is a locally-exploitable elevation-of-privilege flaw (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) in the Windows Projected File System (ProjFS) driver. The vector confirms the attacker must already have local, authenticated code execution at low privilege (AV:L, PR:L) - this is a second-stage escalation primitive, not an initial-access or remote vector. Signals are mutually consistent and point to a LOW-to-MODERATE real-world priority: EPSS is 0.40% (32nd percentile), there is no CISA KEV listing, and no public exploit was identified, so this is not under active or imminent mass exploitation. The 7.8 score is driven entirely by the full C/I/A impact (privilege elevation to SYSTEM/kernel context), not by ease or breadth of access. No SSVC decision data was supplied. Note CWE-126 is a buffer OVER-READ, which most naturally supports information disclosure/crash; achieving full I:H/A:H (write and integrity impact) via an over-read is plausible but not detailed in Microsoft's terse description - the C:H component is the most directly justified by the CWE, while I:H/A:H should be verified against Microsoft's advisory. Overall: a legitimate patch-in-normal-cycle EoP, valuable to an attacker who already has a foothold, but not an emergency.

An attacker who already has the ability to run code as a low-privileged local user (e.g., via a phishing payload or a compromised standard account) invokes the Windows Projected File System interface with crafted input that triggers a buffer over-read in the ProjFS driver, corrupting or leaking kernel-adjacent memory to escalate to SYSTEM. No public proof-of-concept exploit was identified at time of analysis, and exploitation requires prior local access plus no user interaction.