CVE-2025-62464: 
vulnerability analysis and mitigation

CVE-2025-62464 is a buffer over-read vulnerability in the Windows Projected File System (ProjFS) that allows a locally authorized attacker to elevate privileges. It was disclosed on December 9, 2025, as part of Microsoft's December 2025 Patch Tuesday security update. Affected products span a wide range of Windows versions, including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2 Edition, and Windows Server 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The vulnerability is classified as CWE-126 (Buffer Over-read), occurring within the Windows Projected File System driver. An attacker with low-privileged local access can trigger the buffer over-read condition, potentially reading beyond the intended memory boundary into adjacent kernel memory regions. Exploitation requires no user interaction and has low attack complexity, but does require the attacker to already have an authenticated local session on the target system (Microsoft MSRC). No public technical write-ups or proof-of-concept code have been identified at this time.

Successful exploitation allows a low-privileged local attacker to read sensitive kernel memory contents and potentially escalate to higher system privileges, resulting in high confidentiality, integrity, and availability impact. The vulnerability affects a broad range of Windows desktop and server editions, meaning enterprise environments with multi-user systems or shared infrastructure face elevated risk if an attacker already has a foothold. Privilege escalation could enable lateral movement, persistence, or further compromise of the affected host (Microsoft MSRC).

Microsoft released patches for CVE-2025-62464 as part of the December 2025 Patch Tuesday update. Affected systems should be updated to the following minimum build versions: Windows Server 2019 / Windows 10 1809 → 10.0.17763.8146; Windows 10 21H2 → 10.0.19044.6691; Windows 10 22H2 → 10.0.19045.6691; Windows 11 23H2 → 10.0.22631.6345; Windows 11 24H2 / Windows Server 2025 → 10.0.26100.7392; Windows Server 2022 → 10.0.20348.4467; Windows Server 2022 23H2 → 10.0.25398.2025; Windows 11 25H2 → 10.0.26200.7392. In addition to patching, organizations should enforce least-privilege access controls, restrict local user account permissions, and monitor for suspicious local privilege escalation activity (Microsoft MSRC).

CVE-2025-62464 was covered as part of broader December 2025 Patch Tuesday roundups by several security outlets. BleepingComputer noted the December 2025 update addressed 57 flaws including 3 zero-days, with this vulnerability among the batch (BleepingComputer). Zero Day Initiative and Sophos also published December 2025 Patch Tuesday reviews covering the update cycle (ZDI Blog, Sophos News). No specific researcher commentary or notable social media discussion focused exclusively on this CVE was identified.