CVE-2025-62467CWE-126CWE-190

CVE-2025-62467

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

⚡ An integer overflow in Windows Projected File System could pave the way for local privilege escalation — all from an authorized user with a little finesse! 🚀 Think of it like a construction worker sneaking into a secure area of a building using a faulty access card that should only let them in the lobby. With this flaw, they could gain access to the blueprints and tools beyond their permissions, changing everything! With this vulnerability, an attacker could elevate their privileges, accessing sensitive files and resources they shouldn't be able to touch. It’s like giving someone the power to unlock every door in a building just because they mastered the lobby's entrance! This presents a dangerous scenario for system integrity and user data confidentiality.

Put simply

Think of it like a construction worker sneaking into a secure area of a building using a faulty access card that should only let them in the lobby. With this flaw, they could gain access to the blueprints and tools beyond their permissions, changing everything! The issue arises from an integer overflow or wraparound condition, allowing an authorized user to manipulate their access level within the Windows Projected File System, potentially gaining elevated privileges locally.

What to do

With this vulnerability, an attacker could elevate their privileges, accessing sensitive files and resources they shouldn't be able to touch. It’s like giving someone the power to unlock every door in a building just because they mastered the lobby's entrance! This presents a dangerous scenario for system integrity and user data confidentiality. To mitigate this risk, ensure that all affected systems are patched to the latest version provided by Microsoft. Regularly review user permissions to minimize the number of authorized users and maintain strict access control policies. You've got this! By taking these steps, you'll step up your security game and keep those sneaky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weaknesses
CWE-126 · Buffer Over-read; CWE-190 · Integer Overflow or Wraparound
Published
2025-12-09T23:15Z
Affected products (11)
ProductVersionsFixed in
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_1809< 10.0.17763.814610.0.17763.8146
microsoft/windows_10_21h2< 10.0.19044.669110.0.19044.6691
microsoft/windows_10_22h2< 10.0.19045.669110.0.19045.6691
microsoft/windows_11_23h2< 10.0.22631.634510.0.22631.6345
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2019< 10.0.17763.814610.0.17763.8146
microsoft/windows_server_2022< 10.0.20348.446710.0.20348.4467
microsoft/windows_server_2022_23h2< 10.0.25398.202510.0.25398.2025
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Windows Projected File System Elevation of Privilege Vulnerability
    cvelistv5