A buffer over‑read in Windows Projected File System allows an authorized attacker to elevate privileges locally. The flaw is a classic CWE-126 improper bounds checking error that can be triggered when that component reads beyond the bounds of a buffer, potentially enabling privilege escalation.

Affected products include Microsoft Windows 10 versions 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 22H3; Microsoft Windows Server 2019, Windows Server 2022, Windows Server 2025 and their respective Server Core installations. All listed releases contain the vulnerable Projected File System code.

The CVSS score of 7.8 places the vulnerability in the high severity range, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not listed in CISA KEV. The description states that the flaw allows an authorized attacker to elevate privileges locally, implying a local attack vector that requires the attacker to have some legitimate access to the system. Based on the description, it is inferred that the attacker must create or manipulate a projected file system image to trigger the buffer over‑read, but the official advisory does not detail the exact exploitation steps.