CVE-2025-62461CWE-126

CVE-2025-62461

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

⚡ A sneaky buffer over-read in the Windows Projected File System Filter Driver could let an authorized attacker elevate their privileges locally — think of it as an employee gaining access to the executive floor without a keycard! 🔑 This vulnerability is like a construction worker who finds a way to sneak into the management office where critical decisions are made, using a loophole in security protocols that were never intended to allow entry. It’s surprisingly simple, but the impact could be HUGE! An attacker taking advantage of this could gain elevated privileges on the system, potentially allowing them to execute malicious commands, install unauthorized software, or access sensitive data. The consequences could range from data breaches to total system compromise — absolutely devastating!

Put simply

This vulnerability is like a construction worker who finds a way to sneak into the management office where critical decisions are made, using a loophole in security protocols that were never intended to allow entry. It’s surprisingly simple, but the impact could be HUGE! This vulnerability arises from a buffer over-read in the Windows Projected File System Filter Driver, potentially allowing an authorized user to read beyond intended memory boundaries and manipulate access controls.

What to do

An attacker taking advantage of this could gain elevated privileges on the system, potentially allowing them to execute malicious commands, install unauthorized software, or access sensitive data. The consequences could range from data breaches to total system compromise — absolutely devastating! To mitigate this risk, ensure your Windows systems are updated with the latest security patches that address this vulnerability. Monitor user permissions and audit access logs to spot any unexpected activities. It's crucial to maintain a baseline of security to prevent such privilege escalation attempts! You've got this! Stay vigilant and keep your systems fortified! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2025-12-09T23:15Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Projected File System Elevation of Privilege Vulnerability
    cvelistv5