Microsoft Windows CVE-2026-50458

Exploitation requires the attacker to already have local, authenticated access with the ability to run code as at least a standard/low-privileged user on the target (CVSS PR:L, AV:L); it cannot be triggered remotely or by a fully unauthenticated actor. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local code execution exists no additional victim action, special timing, or unusual configuration is required - the vulnerable Brokering File System code ships in default installations of the listed builds. The primary limiting factor is the local-access prerequisite: this is a post-compromise privilege-escalation primitive, and the affected platform must be one of Windows 11 24H2/25H2/26H1 or Windows Server 2025.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) describes a low-complexity local attack requiring only low existing privileges and no user interaction, yielding full confidentiality, integrity and availability impact - the classic profile of an elevation-of-privilege primitive escalating a standard user to SYSTEM. No EPSS score and no SSVC decision data are provided in the input, so exploitation probability cannot be quantified here. It is not in CISA KEV and no POC is referenced, so this is not confirmed actively exploited; however, Brokering File System use-after-free bugs are a recurring, historically exploitable class in Windows local EoP research, so weaponization over time is plausible. Overall this is a genuine patch-priority issue on any multi-user or post-compromise-exposed Windows host because it is a reliable second-stage escalation, but it is not a remotely reachable, mass-exploitable emergency: an attacker must already be able to run code locally as an authenticated user.

An attacker who has already gained low-privileged code execution on a Windows 11 24H2 host - for example via a phishing payload or a compromised standard user account - runs a crafted program that drives the Brokering File System into a use-after-free, grooms the freed allocation, and hijacks the stale reference to execute code as SYSTEM. From there they disable defenses, install persistence, and move laterally. No public exploit code is identified at time of analysis, but the low attack complexity makes reliable exploitation feasible for a skilled attacker.