Camera Frame Server CVE-2025-62570

Exploitation requires the attacker to already have local, authenticated access to an affected host (AV:L, PR:L) and to interact with the Windows Camera Frame Server Monitor component; no remote network path and no victim user interaction are involved (UI:N). The key limiting factors are the need for an existing local foothold with valid low-level privileges and physical/logical presence on a Windows 11 24H2, Windows 11 25H2, or Windows Server 2025 system - this is a post-access confidentiality exposure, not a remotely reachable flaw. Impact is confined to information disclosure; no integrity or availability effect is indicated.

This is a genuine but low-urgency issue. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent and describes a locally-exploitable information-disclosure flaw: the attacker must already have a local, authenticated foothold (PR:L) on the machine, needs no victim interaction (UI:N), and the only impact is high confidentiality loss (C:H) with no integrity or availability effect. All signals point the same direction - low real-world priority. EPSS is 0.40% (33rd percentile), indicating a low modeled probability of exploitation. The vulnerability is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active exploitation. No SSVC decision data was provided in the input. Note a tagging discrepancy: the input Tags include 'Authentication Bypass,' but the CWE (CWE-284, Improper Access Control), the description (local information disclosure by an already-authorized attacker), and PR:L all indicate this is an access-control/info-disclosure bug, not an authentication bypass - treat that tag with skepticism. Bottom line: a legitimate local confidentiality issue worth patching in routine cycles, not an emergency.

A low-privileged but authenticated user (or a sandboxed/standard-user process) already running on a Windows 11 24H2/25H2 or Server 2025 host abuses improper access control in the Camera Frame Server Monitor to read camera-related information they should not be able to access. No proof-of-concept exploit is referenced, and exploitation requires existing local access and valid credentials (PR:L), limiting it to post-compromise or insider scenarios rather than remote attacks.