Windows Projected File System Privilege Escalation

The Windows Projected File System is a feature that allows users to access files on their local machine from a remote desktop session. This vulnerability, CVE-2025-62467, allows an authorized attacker to elevate privileges locally by exploiting an integer overflow or wraparound in the Windows Projected File System.

You're affected if you use Integer overflow or wraparound. Specific version info not stated in the advisory.

1. Apply the security update from Microsoft Security Response Center (https://www.microsoft.com/en-us/safety/online-attack-center/update.aspx).
2. Immediately disable the Projected File System feature in your remote desktop settings.

• Vendor Advisory