Buffer over-read in the Windows Projected File System Filter Driver allows an attacker with local access to read past the bounds of a buffer. This flaw can be used to gain higher privilege privileges on the affected system, potentially enabling the attacker to execute privileged commands or install malicious software. The weakness is a classic underread (CWE‑125). Based on the description, the attacker requires local authorized access, so the attack vector is inferred to be local. When exploited, the attacker can elevate local privileges, compromising confidentiality, integrity, and availability of system resources.

Microsoft Windows 10 versions 1809, 21H2 and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2 and 26H1, and Microsoft Windows Server editions 2019, 2022 and 2025—including Server Core installations—are affected. These versions were listed as vulnerable by Microsoft’s CNA. No other vendors or products are presently affected.

The CVSS score of 7.8 reflects a moderate to high risk, while EPSS is not available, so the exploitation likelihood is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits yet. Because the flaw requires local privileged or authorized access, the attack surface is limited to users logged on to the affected machine. If an attacker already has some local privilege, the over-read can raise that privilege further, enabling broader system compromise or persistence.