Windows ProjFS CVE-2025-62467

Requires the attacker to already have authenticated local access and the ability to execute code as a low-privileged user on the Windows host (PR:L, AV:L, no user interaction). Exploitation targets the Projected File System (ProjFS) driver - a Windows feature used by virtual filesystem providers such as VFS for Git/GVFS - so hosts where ProjFS is loaded/active are the realistic attack surface. There is no remote or network-facing path; the flaw cannot be triggered by an unauthenticated or remote attacker, which is the primary limiting factor on real-world risk.

Signals are internally consistent and point to a genuine but not urgent local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) requires the attacker to already be an authenticated local user, capping real-world reach - there is no remote or unauthenticated path. EPSS is low at 0.40% (32nd percentile), which aligns with a local-only kernel driver flaw that cannot be sprayed across the internet. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is exploitation-plausible rather than exploitation-observed. Net: a real but second-tier priority - patch on the normal Windows monthly cycle unless the host is a multi-user or shared-tenant system where local EOP is a meaningful escalation vector. Note one metadata inconsistency: the assigned CWE-126 (buffer over-read) conflicts with the description's 'integer overflow or wraparound' (CWE-190/191); this is a common MSRC-to-NVD mapping artifact and does not change the local-EOP risk picture, but the precise memory-safety mechanism should be verified against the MSRC advisory.

A low-privileged local user (or malicious/compromised process) on a Windows host interacts with the Projected File System (ProjFS) driver, supplying a crafted value that triggers an integer overflow in size/offset handling. The overflow leads to an out-of-bounds memory condition in kernel context, which the attacker leverages to execute code at SYSTEM and escalate from standard user to full control. No public proof-of-concept is available at time of analysis, and exploitation requires prior local code execution.