CVE-2025-62462: 
vulnerability analysis and mitigation

CVE-2025-62462 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS) that allows a locally authenticated attacker with low privileges to elevate their privileges on the affected system. Disclosed on December 9, 2025, as part of Microsoft's December 2025 Patch Tuesday, it affects a wide range of Windows versions including Windows 10 (21H2, 22H2, 1809), Windows 11 (23H2, 24H2, 25H2), Windows Server 2019, 2022, 2022 23H2, and Windows Server 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (MSRC Advisory, Feedly).

The root cause is classified as CWE-126 (Buffer Over-read) within the Windows Projected File System (ProjFS) driver component. An attacker with a low-privileged local account can trigger the buffer over-read condition, which may expose sensitive kernel memory or allow manipulation of execution flow sufficient to achieve privilege escalation. Exploitation requires no user interaction and has low attack complexity, making it straightforward for an authenticated local attacker to attempt. No public proof-of-concept code or detailed technical write-up has been published as of the disclosure date (MSRC Advisory, Feedly).

Successful exploitation allows a low-privileged local attacker to gain elevated privileges on the affected Windows system, with high impact to confidentiality, integrity, and availability. An attacker could leverage elevated access to install malware, modify system configurations, access sensitive data, or use the compromised system as a pivot point for lateral movement within a network. The broad scope of affected Windows versions — spanning consumer and server editions — significantly widens the potential attack surface (MSRC Advisory, Feedly).

Microsoft released patches for CVE-2025-62462 on December 9, 2025, as part of the December 2025 Patch Tuesday update cycle. Affected versions and their fixed build numbers include: Windows 10 1809/Server 2019 (10.0.17763.8146), Windows 10 21H2 (10.0.19044.6691), Windows 10 22H2 (10.0.19045.6691), Windows 11 23H2 (10.0.22631.6345), Windows 11 24H2/Server 2025 (10.0.26100.7392 or later), Windows 11 25H2 (10.0.26200.7392), Windows Server 2022 (10.0.20348.4467), and Windows Server 2022 23H2 (10.0.25398.2025). Organizations should apply the latest cumulative updates immediately; additionally, restricting local user permissions and deploying endpoint detection and response (EDR) tools are recommended compensating controls (MSRC Advisory, Feedly).

CVE-2025-62462 was covered as part of broader December 2025 Patch Tuesday roundups by security outlets including BleepingComputer, Sophos, Zero Day Initiative (ZDI), and CyberSecurityNews, though it did not receive individual spotlight coverage given the absence of active exploitation. Sophos and ZDI noted the overall December 2025 update as a significant end-of-year release addressing 57 flaws including 3 zero-days, with this EoP vulnerability noted among the batch (BleepingComputer, Sophos, ZDI).