Windows Defender Firewall CVE-2025-62468

Requires the attacker to already possess local, authenticated access to the target host at a low privilege level (AV:L/PR:L) - this is a post-compromise or malicious-insider primitive, not remotely reachable. The affected component is the Windows Defender Firewall Service, which is enabled by default on the listed Windows 11 (23H2/24H2/25H2) and Windows Server (2022 23H2, 2025) builds, so no special configuration is needed once local access is obtained. Exploitation is limited to information disclosure only (C:H, I:N, A:N) - it cannot by itself alter data or crash the host - and requires no user interaction. The principal limiting factor is the local-access prerequisite, which sharply reduces real-world exposure compared with a network-facing flaw.

This is a genuine but low-priority vulnerability. The CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is driven entirely by a high confidentiality impact but is heavily constrained by local attack vector and required low-level authentication - the attacker must already have the ability to run code as an authorized local user on the target host. EPSS is low at 0.52% (42nd percentile), consistent with a local info-disclosure primitive that is not remotely triggerable and thus not attractive for mass automated exploitation. There is no CISA KEV listing and no public exploit code identified, so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: low EPSS, local-only vector, and authenticated prerequisite all point to a targeted, post-compromise information-leak issue rather than an initial-access or wormable threat. The one notable metric is C:H - an out-of-bounds read in a system service (the firewall service runs with elevated privilege) could leak sensitive kernel/service memory to a low-privileged user, which is why it may be useful as one link in a broader local privilege-escalation or sandbox-escape chain rather than as a standalone attack.

A low-privileged local user (or malware already executing in a limited user context) invokes the Windows Defender Firewall Service through a crafted request or malformed input that triggers an out-of-bounds read, causing the elevated service to return adjacent memory contents. The leaked memory could contain sensitive data such as pointers, credentials, or configuration useful for defeating ASLR and enabling a follow-on privilege-escalation exploit. No public proof-of-concept has been identified, and the local-access, authenticated prerequisite means this would appear only in post-compromise or malicious-insider situations.