Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Integer truncation (CWE-190) leading to buffer over-read (CWE-126) in the Windows Projected File System minifilter prjflt.sys PrjfValidateNamesInEnumeration, local EoP info-leak. When validating a returned directory-info entry (e.g. FILE_ID_EXTD_DIR_INFORMATION), PrjfValidateNamesInEnumeration reads the ULONG FileNameLength but truncates it to a USHORT (movzx word ptr [entry+0x3C]) before bounding it (Length = FileNameLength>>1; if Length>0x104 reject) and scanning the name. PRE: because only the low 16 bits are checked, a FileNameLength such as 0x10000C is validated as 0xC, so only the first 0xC bytes of FileName are checked; the downstream copy (PrjfMungeDirectoryEnumerateWithoutShortname -> memmove(dst, Entry->FileName, FileNameLength)) uses the full ULONG 0x10000C, copying the unchecked 0x10000 leaked bytes into the user buffer. Diff of prjflt.sys 10.0.26100.7309 -> .7462 (Dec 9 2025, KB5072033) confirms the fix: gated behind CFR flag Feature_4287139131, PrjfValidateNamesInEnumeration now rejects any entry whose full ULONG FileNameLength exceeds 0xffff (if (0xffff < param_2[2]) return 0xC000000D) before the USHORT truncation, so the validated length matches the copied length.

A ULONG FileNameLength is truncated to USHORT during validation but used in full when copied, so over-length names leak pool to the user buffer

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

ChenJian with Sea Security Orca Team