Windows 11 and Server 2025 Vulnerable to SYSTEM Privilege Escalation via Brokering File System Flaw
A high-severity use-after-free vulnerability (CVE-2026-50458) in Windows' Brokering File System allows local attackers to escalate privileges to SYSTEM.
Microsoft has addressed a critical use-after-free vulnerability, identified as CVE-2026-50458, that impacts Windows 11 and Windows Server 2025. This flaw resides within the Brokering File System (bfs.sys), a minifilter driver responsible for managing file, pipe, and registry access between sandboxed applications and the operating system.
The vulnerability stems from a race condition in the BFS driver's internal directory handling. When concurrent operations are performed on the same file path, it can lead to kernel objects being freed while they are still in use. This memory corruption allows a local attacker, who already has authenticated access or code execution within a sandboxed environment, to manipulate multiple threads and ultimately gain SYSTEM-level privileges.
According to security researchers, exploitation requires an attacker to send crafted IOCTL requests to the BFS device and misuse its policy-setting interface. By triggering the race condition, an attacker can corrupt kernel memory, thereby achieving a full privilege escalation to the highest level on the affected system. This effectively bypasses the intended isolation mechanisms of sandboxed applications.
Microsoft has classified this vulnerability with a CVSS 3.1 score of 7.8, denoting a high severity. The affected versions include Windows 11 versions 24H2, 25H2, and 26H1 on both x64 and ARM64 architectures, as well as Windows Server 2025. Specific vulnerable build numbers have been identified, with patches available in the July 2026 cumulative updates.
As of the disclosure, there have been no confirmed reports of this vulnerability being actively exploited in the wild, nor has it been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the widespread use of Windows 11 and Windows Server in enterprise environments and the critical nature of kernel-level privilege escalation, security teams are urged to prioritize patching.
Microsoft released a fix for CVE-2026-50458 as part of its July 14, 2026 Patch Tuesday updates. This fix is included in cumulative update KB5101650 for affected Windows 11 versions and corresponding updates for Windows Server 2025. Organizations should verify their systems' build numbers against the vulnerable ranges and apply these security updates promptly.
In scenarios where immediate patching is not feasible, security measures such as restricting local logon and execution rights for low-privileged accounts, tightening application control policies, and closely monitoring BFS driver activity can serve as temporary mitigations. These steps can help reduce the attack surface until the systems can be fully updated.