CVE-2026-62751

CVE-2026-62751 is an integer overflow in Microsoft's Projected Filesystem (ProjFS) that warrants more attention than its CVSS score suggests. ProjFS isn't peripheral code—it underlies OneDrive Files On-Demand and Windows Search indexing, meaning this vulnerability sits at the choke point for data that flows into Microsoft's own cloud sync and search infrastructure. The overflow occurs in callback validation logic where ProjFS transitions between kernel and user mode. Values originating from the filesystem layer—where truncation and integer edge cases are predictable—undergo arithmetic operations without overflow checking before determining buffer allocations for projected file content. This is not a random developer error; it's a design failure at the architectural seam. The kernel-to-user handoff is a known vulnerability lineage across filesystem filters, and ProjFS inherits that lineage despite Microsoft's own safe integer guidance existing for over a decade. The 'authorized attacker' prerequisite in the CVE description is misleading in practice. Any userland code that can trigger file projection—which is essentially every process on a Windows system—reaches the vulnerable code path. The prerequisite effectively collapses to 'any code with filesystem access,' which is no constraint at all. Malware operating at medium integrity (Emotet, TrickBot, and similar post-exploitation tools) reliably chainsaw privilege escalations in this exact vulnerability bracket. The authorized classification serves as a deprioritization mechanism rather than a genuine exploitability boundary. The deeper risk is downstream poisoning. Exploiting this overflow doesn't just yield local privilege escalation—it lets an attacker manipulate the buffer sizes for projected file data that OneDrive syncs and Search indexes. A successful exploit can corrupt data that propagates across sessions and, via OneDrive re-sync, potentially across machines. This blast radius is what makes the current scoring feel underweighted: the vulnerability's true severity lies in its position as a single point of trust failure for an entire subsystem ecosystem. Defenders should prioritize: confirm whether KB5002537 or subsequent ProjFS updates contain the overflow guard; audit other arithmetic operations in ProjFS callback handlers for similar patterns; and treat any ProjFS patch with unusual scrutiny given the callback handoff's history of re-introducing fixed vulnerabilities during performance optimization cycles. The safe integer primitives exist in Microsoft's own libraries—the question is whether they were applied, and if so, whether they survived subsequent code changes.

Reviewed through automated stages and approved by a human before publication.