CVE-2025-62462CWE-126

CVE-2025-62462

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

⚡ An authorized attacker can exploit a buffer over-read in Windows Projected File System to elevate privileges locally, like a sneaky invader discovering a secret room in a castle! 🏰 Think of it like a restaurant with a hidden kitchen stocked with gourmet ingredients that only certain staff should access. If an authorized employee finds a way to peek into that kitchen, they could whip up some dangerous chef specials without anyone knowing. This vulnerability could allow an attacker to gain elevated privileges on the system, potentially giving them full control to access sensitive data or perform unauthorized actions. Imagine the chaos if someone could unlock all the doors from the inside — they could wreak havoc on your entire network!

Put simply

Think of it like a restaurant with a hidden kitchen stocked with gourmet ingredients that only certain staff should access. If an authorized employee finds a way to peek into that kitchen, they could whip up some dangerous chef specials without anyone knowing. The buffer over-read flaw in Windows Projected File System allows attackers, with initial access, to read beyond the intended memory boundaries, leading to unauthorized access to privileged information or functionality.

What to do

This vulnerability could allow an attacker to gain elevated privileges on the system, potentially giving them full control to access sensitive data or perform unauthorized actions. Imagine the chaos if someone could unlock all the doors from the inside — they could wreak havoc on your entire network! To mitigate this issue, ensure that your Windows systems are updated with the latest patches from Microsoft. Regularly audit user permissions to minimize the number of authorized users and limit access where possible. Additionally, consider implementing monitoring tools to detect unusual privilege escalations. You've got this! With a little diligence, you can seal up this vulnerability and keep your systems safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.3th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2025-12-09T23:15Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Projected File System Elevation of Privilege Vulnerability
    cvelistv5