Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Buffer over-read (CWE-126) in the Windows Projected File System minifilter prjflt.sys enumeration validation/advance mismatch, local EoP info-leak. PrjfValidateNamesInEnumeration validates directory-info entries but, when an entry's NextEntryOffset is 0, it validates only that entry and returns without checking any following entry. PrjfAdvanceToNextEnumEntry, however, when NextEntryOffset is 0, still advances to a next entry by computing FileNameOffset + FileNameLength. PRE: a result buffer with two entries whose first entry has NextEntryOffset==0 is only validated for the first entry, yet PrjfMergeEnumerationResults -> PrjfAdvanceToNextEnumEntry advances to the second, unvalidated entry and PrjfMungeDirectoryEnumerateWithoutShortname copies its (attacker-shaped) data - including leaked pool - to the user buffer. Diff of prjflt.sys 10.0.26100.7309 -> .7462 (Dec 9 2025, KB5072033) confirms the fix: gated behind CFR flag Feature_3797454136, PrjfAdvanceToNextEnumEntry no longer advances past a zero NextEntryOffset - when NextEntryOffset==0 it sets the entry offset to 0xffffffff (stop) instead of adding FileNameOffset+FileNameLength, so validation and advancement stay in agreement.

Enumeration validation stops at a zero NextEntryOffset but advancement does not, so a second unvalidated entry is copied to the user

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

ChenJian with Sea Security Orca Team