# CVE-2025-62462 — Windows Projected File System `prjflt.sys` Unchecked `ResultLength` in `PrjfCompleteCommandHandler` → Kernel Pool Over-Read

---

## Summary

| | |
|---|---|
| **Product** | Windows — `prjflt.sys` (Windows Projected File System / ProjFS minifilter; command completion) |
| **CVE ID** | CVE-2025-62462 |
| **Impact** | Elevation of Privilege (kernel pool information disclosure) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-126: Buffer Over-read |
| **Delivery** | Local — a crafted "complete command" message to the ProjFS communication port |
| **KB / Fixed build** | KB5072033 — `prjflt.sys` 10.0.26100.7462 (Win11 24H2 x64) |
| **Patch Date** | December 9, 2025 (2025-Dec) |
| **Pre-patch binary** | `prjflt.sys` 10.0.26100.7309 — SHA256 `933e0862552cf839905efb55bd867a43881eed1680051096d6b6b5250e5674c8` |
| **Post-patch binary** | `prjflt.sys` 10.0.26100.7462 — SHA256 `2a9350bc757df5a7480494b2faf40813731baf0dd26c6383b6d86f46dee68468` |
| **Feature flag** | `Feature_2814151992` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`prjflt.sys` is the Windows Projected File System (ProjFS) minifilter. A user-mode
ProjFS provider talks to it over a filter communication port; `PrjfPortMessage`
copies each inbound message into a pool buffer and dispatches a handler.
`PrjfCompleteCommandHandler` lets the provider supply the result of a queued command
(e.g. a directory-enumeration result) and copies that result into the waiting
command entry's `OutputBuffer`:

```c
struct _PRJ_MSG_COMPLETE_COMMAND_HANDLER_IN_DATA {
    ULONG DataSize;          // *param_2
    ...
    ULONG CommandId; int RetStatus;
    ULONG ResultLength;      // param_2[0x18]  <- attacker-controlled
    char  ResultBuffer[];    // param_2 + 0x19
};
// PrjfCompleteCommandHandler:
memmove(CommandEntry->OutputEntry->OutputBuffer, MessageData->ResultBuffer, MessageData->ResultLength);
```

---

## Vulnerability Summary

`MessageData` is the pool copy of the user message, so `ResultLength` is fully
attacker-controlled. Pre-patch, `PrjfCompleteCommandHandler` did not validate
`ResultLength` against the actual `MessageData` allocation before the `memmove`, so
a `ResultLength` larger than the buffer copies **adjacent kernel pool memory** past
the end of `ResultBuffer` into `OutputBuffer`:

> If the `MessageData` pool block is `0x100` and `ResultLength` is `0x200`, at
> least an additional `0x100` bytes of neighbouring pool are copied into
> `OutputBuffer`.

`OutputBuffer` is a directory-information structure
(`FILE_ID_EXTD_DIR_INFORMATION` and friends) that is subsequently returned toward
the caller, so the leaked pool bytes are disclosed (CWE-126). ProjFS runs in the
kernel and the port is reachable by a low-privileged local user, making this a
local EoP/information-disclosure primitive.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): connect to the ProjFS port and
  send a "complete command" message for a queued command.
- Set `ResultLength` (`param_2[0x18]`) larger than the `MessageData` allocation.
- Result: the `memmove` over-reads adjacent pool into the returned directory buffer.

---

## Vulnerability Details

### Root Cause

`ResultLength` (a user-controlled field of the message pool buffer) was used
directly as the `memmove` length without being bounded against the message's real
size (`DataSize`) or the allocation, so an over-large value read past the buffer.

### The patch (confirmed — diff, .7309 → .7462)

Gated behind `Feature_2814151992`, `PrjfCompleteCommandHandler` now **bounds
`ResultLength` before the copy** — it adds the fixed header (`0x64`), rejects the
value on integer overflow, and rejects it when it exceeds the declared `DataSize`:

```c
// PrjfCompleteCommandHandler (10.0.26100.7462) — PATCHED, feature-enabled branch (from our diff)
if (Feature_2814151992__private_IsEnabledDeviceUsageNoInline()) {
    uVar1 = param_2[0x18] + 100;            // ResultLength + 0x64 (header)
    if (uVar1 < param_2[0x18])  goto reject;// integer-overflow guard
    if (*param_2 < uVar1)       goto reject;// DataSize must cover ResultLength+header
}
```

With `ResultLength + 0x64` required to fit inside `DataSize` (and the overflow
guard), an over-large `ResultLength` is refused before the `memmove`, closing the
over-read.

### Patch Completeness Assessment

**CFR-gated behind `Feature_2814151992`.** The bounds check runs only when the flag
is enabled; the original unchecked copy still ships when disabled. Verify
`Feature_2814151992` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** ProjFS "complete command" messages whose `ResultLength` approaches
or exceeds the message size; over-read / pool-read anomalies reached from
`prjflt!PrjfCompleteCommandHandler` → `memmove` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_2814151992` is enabled.

---

## References

- MSRC advisory — CVE-2025-62462 (Windows Projected File System Elevation of Privilege), released 2025-12-09, KB5072033.
- Full binary diff: `/data/patch_diffs/prjflt_sys-kb5072033-dec2025-ghidriff.md`
- Related same-KB ProjFS enumeration info-leaks: CVE-2025-62464, CVE-2025-62467, CVE-2025-55233.