CVE-2025-62461: 
vulnerability analysis and mitigation

CVE-2025-62461 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS) Filter Driver that allows an authorized local attacker to elevate privileges. Disclosed on December 9, 2025, as part of Microsoft's December 2025 Patch Tuesday, it affects a wide range of Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), Windows Server 2019, 2022, 2022 23H2, and Windows Server 2025. It carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The vulnerability is classified as CWE-126 (Buffer Over-read), occurring within the Windows Projected File System Filter Driver (PrjFlt.sys). A low-privileged, authenticated local attacker can trigger the buffer over-read condition to gain elevated privileges on the affected system. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once local access is obtained. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (Microsoft MSRC, BleepingComputer).

Successful exploitation allows a low-privileged authenticated attacker to escalate to higher system privileges, potentially gaining administrative-level access. This could enable the attacker to access sensitive system information, modify system configurations, execute privileged commands, and potentially achieve full system compromise. The impact spans confidentiality, integrity, and availability — all rated High in the CVSS scoring (Microsoft MSRC).

Microsoft released security updates on December 9, 2025, addressing this vulnerability across all affected Windows versions. Patched builds include: Windows 10 1809/Server 2019 (10.0.17763.8146), Windows 10 21H2 (10.0.19044.6691), Windows 10 22H2 (10.0.19045.6691), Windows 11 23H2 (10.0.22631.6345), Windows 11 24H2/Server 2025 (10.0.26100.7392), Windows 11 25H2 (10.0.26200.7392), Windows Server 2022 (10.0.20348.4467), and Windows Server 2022 23H2 (10.0.25398.2025). Organizations should apply the December 2025 cumulative updates immediately via Windows Update or WSUS, and enforce the principle of least privilege to reduce the attack surface (Microsoft MSRC).

The vulnerability was covered as part of broader December 2025 Patch Tuesday roundups by multiple security outlets. BleepingComputer noted it among 57 flaws fixed that month, while Zero Day Initiative and Sophos included it in their monthly patch review summaries. No specific researcher commentary or notable social media discussion focused exclusively on this CVE has been identified (BleepingComputer, ZDI, Sophos).