Brokering File System EUVD-2026-22530

Requires the attacker to already have local, authenticated low-privilege code execution on the affected Windows host (PR:L, AV:L) - this is not remotely reachable. Exploitation further depends on winning a timing-dependent race condition in the Brokering File System (CWE-362), reflected as AC:H, meaning the attacker must repeatedly attempt the operation to hit a narrow window and success is non-deterministic. No user interaction is needed (UI:N) and no special product feature or non-default configuration is called out in the description; the component is present by default on all affected Windows 10/11 and Windows Server 2016-2025 builds below the patched versions. The practical limiting factors are the prerequisite local foothold and the unreliability of the race, which together sharply reduce real-world exploitability despite total technical impact.

Signals are consistent and point to a genuine but non-urgent local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local attacker who already holds low-level (authenticated) access and must win a race condition, reflected in the high attack complexity; impact is total (C:H/I:H/A:H), matching the SSVC 'Technical Impact: total' rating and the base score of 7.0. However, exploitation likelihood is low: EPSS is only 0.04% (12th percentile), there is no CISA KEV listing, no public exploit code, and SSVC records 'Exploitation: none' and 'Automatable: no' - the latter being expected for a timing-dependent race that is hard to reliably weaponize. In short, this is a legitimately high-severity flaw by impact but currently a low real-world-risk item: it requires prior local code execution, is difficult to trigger reliably (AC:H), and shows no evidence of exploitation. It warrants normal patch-cycle remediation rather than emergency action, with priority raised on multi-user or shared Windows hosts where untrusted local users exist. No conflicting signals were observed; the chief limitation is that all primary data originates from Microsoft/NVD with no independent corroboration.

A local, low-privileged user running code on an affected Windows host repeatedly triggers a timing window in the Brokering File System to win a race condition and corrupt a privileged operation, gaining SYSTEM-level privileges. Because attack complexity is high, the attacker likely loops the exploit many times to hit the narrow window. No public exploit code has been identified at time of analysis.