Skip to main content

Windows 11 24h2 CVE-2026-25167

HIGH
Use After Free (CWE-416)
2026-03-10 secure@microsoft.com
Denial Of Service Use After Free Memory Corruption Microsoft Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2025
7.4
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Trigger use-after-free in Brokering File System
  2. Exploit
    Corrupt kernel memory structures
  3. Impact
    Escalate privileges to SYSTEM

Vulnerability Assessment

Weakness
CWE
CWE-416
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Local machine access required. Attacker must execute code in user-mode context with ability to interact with Brokering File System APIs. Specific race condition in memory deallocation must be triggered—requires precise timing.
Impact

CVSS 7.4 (HIGH). Attack vector: Local. Complexity: High. Privileges required: None. User interaction: None. Exploitation no authentication required. Exploitable via local access.
Exploit ScenarioDerived

An attacker without authentication could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Privilege escalation in Microsoft's Brokering File System on Windows 11 (24h2 and 25h2) stems from a use-after-free vulnerability that allows local attackers to gain elevated system privileges. An attacker with local access can exploit memory corruption to execute arbitrary code with higher privileges, potentially compromising system integrity. No patch is currently available for this vulnerability.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 7.4

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally. [CVSS 7.4 HIGH]

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

microsoft windows_11_version_24h2_10_0_26100_8037 fix: Windows 11 Version 24H2 for ARM64-based Systems 10.0.26100.8037, Windows 11 Version 24H2 for x64-based Systems 10.0.26100.8037
microsoft windows_11_version_25h2_10_0_26200_8037 fix: Windows 11 Version 25H2 for ARM64-based Systems 10.0.26200.8037, Windows 11 Version 25H2 for x64-based Systems 10.0.26200.8037
microsoft windows_11_version_26h1_10_0_28000_1719 fix: Windows 11 Version 26H1 for ARM64-based Systems 10.0.28000.1719, Windows 11 version 26H1 for x64-based Systems 10.0.28000.1719
microsoft windows_server_2025_10_0_26100_32522 fix: Windows Server 2025 10.0.26100.32522, Windows Server 2025 (Server Core installation) 10.0.26100.32522

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-416 (Use After Free). Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

Know when Windows 11 24h2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

Executive ViewAI

Why It Matters

A critical privilege escalation vulnerability in Microsoft Brokering File System (CVE-2026-25167) allows local attackers to gain elevated system access without a vendor patch currently available. This poses a significant risk to any organization running affected Microsoft systems, as compromised user accounts could escalate to administrative privileges, enabling data theft, malware deployment, or system compromise.

Business Impact: High
Compensating Controls

Disable Microsoft Brokering File System if not operationally required. Implement strict application whitelisting and code integrity policies. Deploy enhanced EDR/XDR monitoring for privilege escalation indicators. Enforce principle of least privilege and restrict local administrative access. Apply Windows Sandbox or similar isolation for untrusted workloads. Monitor and audit all file system API calls at the kernel level. Segment networks to limit lateral movement from compromised endpoints.

Threat Intelligence Overview

EPSS Score
0.0%
Top 91% exploitable
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*

Related Vulnerabilities in Microsoft Windows Multiple Privilege Escalation

View all 37
CVE-2026-23673 HIGH
7.8
CVE-2026-24287 HIGH
7.8
CVE-2026-25165 HIGH
7.8
CVE-2026-23667 HIGH
7.0
CVE-2026-24290 HIGH
7.8
CVE-2026-25174 HIGH
7.8
CVE-2026-25187 HIGH
7.8
CVE-2026-23665 HIGH
7.8
CVE-2026-23668 HIGH POC
7.0
CVE-2026-23669 HIGH
8.8
CVE-2026-23671 HIGH
7.0
CVE-2026-23672 HIGH
7.8
CVE-2026-23674 HIGH
7.5
CVE-2026-24283 HIGH
8.8
CVE-2026-24285 HIGH
7.0
CVE-2026-24289 HIGH
7.8
CVE-2026-24291 HIGH POC
7.8
CVE-2026-24292 HIGH
7.8
CVE-2026-24293 HIGH
7.8
CVE-2026-24294 HIGH
7.8
CVE-2026-24295 HIGH
7.0
CVE-2026-24296 HIGH
7.0
CVE-2026-25169 MEDIUM
6.2
CVE-2026-25170 HIGH
7.0
CVE-2026-25171 HIGH
7.0
CVE-2026-25172 HIGH POC
8.0
CVE-2026-25173 HIGH POC
8.0
CVE-2026-25175 HIGH
7.8
CVE-2026-25176 HIGH
7.8
CVE-2026-25177 HIGH
8.8
CVE-2026-25178 HIGH
7.0
CVE-2026-25179 HIGH
7.0
CVE-2026-25181 HIGH
7.5
CVE-2026-25188 HIGH
8.8
CVE-2026-25189 HIGH
7.8
CVE-2026-25190 HIGH
7.8

More in Windows 11 24h2

View all
CVE-2025-33053 HIGH POC
8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
CVE-2025-33073 HIGH POC
8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
CVE-2013-3900 MEDIUM
5.5 Dec 11

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update

CVE-2025-21293 HIGH POC
8.8 Jan 14

Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
CVE-2024-43461 HIGH
8.8 Sep 10

Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
CVE-2025-30397 HIGH POC
7.5 May 13

Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the

CVE-2024-49039 HIGH POC
8.8 Nov 12

Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
CVE-2026-96951 HIGH POC
8.8 Oct 13

Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
CVE-2026-81963 HIGH POC
7.8 Sep 08

Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
CVE-2025-26633 HIGH POC
7.0 Mar 11

A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute

CVE-2026-68820 HIGH POC
7.0 Aug 11

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
CVE-2025-32706 HIGH POC
7.8 May 13

Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://vuldb.com/?id.350009 REF https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25167

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy