Brokering File System CVE-2025-59189

Requires the attacker to already have local, authenticated access with low-level privileges on an affected host (PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point. Exploitation is limited by high attack complexity (AC:H): the use-after-free (CWE-416) must be triggered and the freed object reliably reclaimed, typically requiring a race-condition win or precise timing, which reduces reliability. No user interaction is needed (UI:N). Affected deployments are default installations of Windows 11 24H2, Windows 11 25H2, and Windows Server 2025 running the Brokering File System component; no special non-default configuration is indicated in the description.

This is a locally-exploitable elevation-of-privilege flaw with a moderate CVSS of 7.0. The CVSS vector (AV:L/AC:H/PR:L/UI:N) is internally consistent with the description's 'elevate privileges locally': it requires local access and already-held low privileges (PR:L), and critically carries high attack complexity (AC:H) - expected for a CWE-416 use-after-free, which typically depends on winning a memory-timing/race condition. All exploitation signals point to lower urgency: EPSS is only 0.26% (16th percentile), the CVE is not in CISA KEV, and no public exploit was identified in the provided data. The status is therefore 'no public exploit identified at time of analysis.' Despite C:H/I:H/A:H (full compromise of the local host once exploited), the combination of local-only vector, required authentication, high complexity, and low EPSS makes this a patch-on-normal-cycle issue rather than an emergency - it is not a high-CVSS-but-trivial problem, but neither is it a drop-everything priority. Note that the input Tags include 'Denial Of Service,' which is a weaker characterization than the actual privilege-escalation impact described; the A:H metric does imply availability impact, but the primary consequence is EoP, not DoS.

A low-privileged user or malware already running on a Windows 11 24H2/25H2 or Windows Server 2025 host locally triggers a use-after-free in the Brokering File System to corrupt kernel/service memory and execute code in a higher-privileged context, escalating toward SYSTEM. Because attack complexity is high (AC:H), the attacker likely must win a race or manipulate timing to reliably reclaim the freed object. No public proof-of-concept was identified in the provided data.