A buffer over-read in the Windows Projected File System Filter Driver can be exploited by an authenticated user, allowing them to gain higher privileges on the local system. The vulnerability is a classic out‑of‑bounds read flaw (CWE‑126) that can disclose sensitive data and elevate the attacker’s permissions. The impact is strictly local; an attacker must already have some access to the affected machines in order to trigger the flaw. Once the over‑read is achieved, the attacker can execute code with elevated privileges and potentially compromise system integrity.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1809 through 22H2, Windows 11 versions 22H3 through 25H2, and Windows Server editions 2019, 2022, and 2025 (both standard and Server Core installations). All listed systems run the Projected File System and are susceptible if not updated to the mitigated build.

The CVSS base score of 7.8 indicates high severity, while the EPSS score of less than 1 % reflects a low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires local access to the target system, which limits the attack surface but still poses significant risk to organizations that rely on the default trust model of Windows. The attack vector is inherently local and authorized, as the attacker must authenticate to the system to trigger the flaw.