Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally.

The remote Windows host is missing security update 5071417. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to     execute code over a network. (CVE-2025-62456)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071547 or hotpatch 5071413. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to     execute code over a network. (CVE-2025-62456)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071542. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to     execute code over a network. (CVE-2025-62456)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071546. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5071544. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

  - Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges     locally. (CVE-2025-62458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5072033 or hotpatch 5072014. It is, therefore, affected by multiple vulnerabilities

  - Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized     attacker to execute code over a network. (CVE-2025-62549)

  - Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to     execute code over a network. (CVE-2025-62456)

  - Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate     privileges locally. (CVE-2025-62457)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277996	KB5071417: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277994	KB5071547: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277990	KB5071542: Windows 11 version 22H2 / Windows Server version 23H2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277988	KB5071546: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277987	KB5071544: Windows 10 version 1809 / Windows Server 2019 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	high
277986	KB5072033: Windows 11 Version 24H2 / Windows Server 2025 / Windows 11 Version 25H2 Security Update (December 2025)	Nessus	Windows : Microsoft Bulletins	medium

Detections

Analytics

CVE-2025-55233

high

Tenable Plugins

high

high

high

high

high

medium