An integer overflow or wraparound in the Windows Projected File System allows an authenticated user to manipulate internal calculations that determine privileges, providing an opportunity to increase their authority to that of a higher‑level account. The flaw involves an integer overflow or wraparound (CWE‑190) and relates to improper bounds handling (CWE‑126). If exploited, the attacker can locally gain elevated rights, potentially enabling system‑wide changes or unauthorized data access.

Microsoft Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, as well as Windows Server 2019, 2022, 2025 and their Server Core installations are affected. Both 32‑bit and 64‑bit builds are listed, making a wide range of client and server machines vulnerable.

The CVSS score is 7.8, indicating a high severity impact. The EPSS score is below 1 %, meaning exploitation is considered unlikely but still feasible for a determined local attacker. The vulnerability is not yet in the CISA KEV catalog, but that does not reduce the need for immediate patching. Exploitation requires local access and knowledge of projected file system operations; once achieved, the attacker can gain system‑level privileges.