Application Information Service CVE-2025-62572

Exploitation requires the attacker to already possess valid low-privileged local access to the target (PR:L, AV:L) - this is a post-authentication local privilege escalation, not remote or unauthenticated. The specific component is the Windows Application Information Service (AppInfo), the service that brokers UAC elevation; the attacker triggers an out-of-bounds read within it, with no user interaction needed (UI:N) and low attack complexity (AC:L). Limiting factors: the attacker must first obtain code execution or an interactive/authenticated session on the host, so this is only reachable as a second-stage action after an initial foothold. Affected scope is limited to Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 per the provided CPEs; other Windows versions are not listed as affected in this input.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already has low-privileged authenticated access to a Windows host can trigger an out-of-bounds read (CWE-125) in Application Information Services (the AppInfo service behind UAC elevation) to gain high confidentiality, integrity, and availability impact - consistent with escalation to SYSTEM. The signals are internally consistent: the vector requires local access and existing low privileges, which aligns with the description's 'authorized attacker ... elevate privileges locally.' Prioritization signals are moderate rather than urgent: EPSS is only 0.40% (33rd percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied in the input. The net picture is a credible, genuinely useful post-compromise privilege-escalation primitive (typical second-stage objective after initial foothold) rather than a remotely-wormable crisis - a real patch-cycle priority for Windows fleets but not an emergency absent evidence of exploitation. Note the low EPSS should not be read as 'safe'; EPSS models breadth of opportunistic exploitation and tends to under-rate local EoP bugs that are nonetheless heavily used in real intrusion chains.

An attacker who has already gained a low-privileged foothold on a Windows 11 24H2/25H2 or Windows Server 2025 host (e.g. via phishing or stolen credentials) invokes the Application Information Service in a way that triggers an out-of-bounds read, corrupting or leaking memory to elevate to SYSTEM. This requires local authenticated access and no user interaction, but complexity is low once a foothold exists. No public exploit code is referenced at time of analysis.