EUVD-2026-43975
GHSA-45rx-ww54-53rf
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only EoP requiring an existing low-priv foothold (AV:L/PR:L) and a memory-corruption race (AC:H), yielding full SYSTEM control with High C/I/A and unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Brokering File System (bfs.sys/Bfs component) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 (including Server Core), where a use-after-free (CWE-416) lets an already-authenticated local attacker corrupt kernel/broker memory to gain SYSTEM-level privileges. Exploitation requires low privileges but high attack complexity, and there is no public exploit identified at time of analysis. Microsoft has released a patch via its MSRC update guide.
Technical ContextAI
The Brokering File System is a Windows component that brokers file-system access requests between lower-privileged callers (such as sandboxed/AppContainer processes and UWP apps) and privileged file operations, enforcing capability and access checks on behalf of constrained callers. The flaw is a use-after-free (CWE-416): the component continues to reference an object after it has been freed, allowing an attacker who controls subsequent heap/pool allocations to reclaim that memory and manipulate a dangling pointer. Because the broker runs with elevated privilege, corrupting its object state can redirect execution or writes to grant the attacker higher privileges. Per the supplied CPE data the exact affected editions are Windows 11 version 24H2, 25H2 and 26H1, plus Windows Server 2025 and Windows Server 2025 Server Core installation.
RemediationAI
Apply the Microsoft security update for your specific Windows edition - Patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49162, which lists the exact patched build numbers for Windows 11 24H2/25H2/26H1 and Windows Server 2025 (including Server Core); consult the MSRC update guide for the KB corresponding to your build rather than relying on a single version string. No standalone workaround is documented by the vendor. As compensating controls until patched, limit the number of low-privileged and interactive/RDP users on affected hosts to reduce the pool of authenticated attackers who could stage the local exploit (trade-off: operational restriction on shared/terminal-server systems), enforce least privilege and application allow-listing to make it harder to run exploit tooling, and monitor for unexpected crashes or exploitation attempts against the Brokering File System component. Because exploitation is local and authenticated, hardening the initial access boundary (preventing the low-priv foothold) meaningfully reduces exposure.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today