Brokering File System CVE-2025-62469

Requires the attacker to already possess a low-privileged authenticated local account or code execution on the target Windows 11 24H2/25H2 or Windows Server 2025 host (AV:L, PR:L) - there is no remote or network attack path and no user interaction is needed (UI:N). The defining limiting factor is the race condition itself (AC:H): exploitation depends on winning a narrow, non-deterministic timing window in the Brokering File System's improperly synchronized shared resource, so attempts are probabilistic and typically must be repeated. No special non-default product configuration is called out in the description; the prerequisite is simply local, authenticated access to an affected Windows build.

This is a locally-exploitable elevation-of-privilege flaw (CWE-362 race condition) in the Microsoft Brokering File System, scored CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent and point to a meaningful-but-not-emergency priority: the full C:H/I:H/A:H impact (complete local system compromise) is tempered by two real brakes - AV:L means the attacker must already be able to execute code on the host, and AC:H reflects the inherent unreliability of winning a race-condition timing window. PR:L confirms an authorized (low-privileged) local account is the required starting point, so this is a post-access privilege-escalation primitive, not an initial-access bug. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. Net: a credible second-stage escalation vector (valuable in a chained local attack) rather than a widely, remotely weaponizable critical - patch on the normal Patch-Tuesday cadence with priority on multi-user and shared/terminal hosts. Note the input 'Information Disclosure' tag conflicts with the description, which explicitly states privilege elevation; the CVSS C:H supports a confidentiality impact but the primary impact type is EoP, so treat the tag with caution.

A low-privileged local user (or malware already running under a standard account) repeatedly triggers Brokering File System operations to hit the unsynchronized shared-resource window, racing a TOCTOU condition to manipulate a brokered file operation and gain SYSTEM-level privileges. Success is probabilistic because AC:H reflects the narrow timing window, so the attacker loops the attempt until the race is won. No public exploit code is referenced in the available data.