High-Severity Brokering File System Flaw Exposes Windows 11, Server 2025

Key Takeaways

• A critical local privilege escalation flaw, CVE-2026-50458, has been discovered in Microsoft’s Brokering File System (BFS).
• Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 are affected.
• The vulnerability, rated 7.8 CVSS, stems from a use-after-free condition in the bfs.sys driver.
• Exploitation requires local authenticated access and can lead to SYSTEM-level control.
• Microsoft issued a fix in the July 2026 Patch Tuesday updates.

High-Severity Flaw in Windows Brokering File System Exposes Modern Windows Platforms

A significant security vulnerability, identified as CVE-2026-50458, has been found within Microsoft’s Brokering File System (BFS), a core component of Windows 11 and Windows Server 2025. This high-severity flaw enables local privilege escalation, allowing an attacker with authenticated access to gain elevated permissions on affected systems.

Understanding the Vulnerability

The vulnerability resides in bfs.sys, a minifilter driver crucial for mediating file, pipe, and registry interactions between sandboxed applications (such as AppContainer and Universal Windows Platform apps) and the operating system kernel. The flaw is a use-after-free condition, triggered by a race condition during concurrent operations on the same path within BFS’s internal directory handling. This can cause kernel objects to be deallocated while still in active use, leading to memory corruption and a breach of memory safety principles.

Microsoft has classified this issue as an elevation-of-privilege vulnerability, assigning it a CVSS 3.1 score of 7.8, indicating a substantial risk. Exploitation of CVE-2026-50458 necessitates local authenticated access, typically by a low-privileged user or through code execution within a sandboxed environment.

Attackers can craft specific IOCTL requests to the BFS device and manipulate its policy-setting interface, orchestrating multiple threads through the vulnerable code path. This manipulation ultimately corrupts kernel memory, leading to a successful privilege escalation to SYSTEM-level access. According to Rotcee’s advisory on GitHub, this race condition and use-after-free flaw grants attackers full control over compromised systems, impacting confidentiality, integrity, and availability.

Despite BFS’s design intent to enforce strict isolation for sandboxed applications, this vulnerability effectively bypasses that security boundary, permitting an attacker to transition from a restricted environment to complete system control.

Affected Systems and Patch Information

The vulnerability impacts Windows 11 versions 24H2, 25H2, and 26H1, across both x64 and ARM64 architectures. Windows Server 2025, including Server Core installations, is also affected. Specifically, vulnerable builds include:

• Windows 11 24H2: Builds earlier than 26100.8875
• Windows 11 25H2: Builds earlier than 26200.8875
• Windows 11 26H1: Builds earlier than 28000.2269
• Windows Server 2025: Builds earlier than 26100.33158

These older builds make applications relying on sandboxing particularly susceptible. Microsoft addressed this vulnerability in its July 14, 2026 Patch Tuesday release. The fix is included in cumulative update KB5101650 for Windows 11 versions 24H2 and 25H2, with corresponding updates for 26H1 and Windows Server 2025.

As of now, there are no confirmed reports of CVE-2026-50458 being actively exploited in the wild, nor does it appear on CISA’s Known Exploited Vulnerabilities list. However, given the kernel-level nature of the flaw and the widespread deployment of Windows 11 and Server 2025 in enterprise environments, security teams must prioritize its remediation.

What You Should Do

• Apply Patches Immediately: Organizations should integrate the July 2026 security updates into their patching schedules without delay. Ensure that all Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 systems are updated to the patched builds (e.g., KB5101650).
• Verify Build Numbers: Assess your systems running Windows 11 or Server 2025 and cross-reference their current build numbers against the vulnerable ranges to confirm remediation.
• Implement Temporary Mitigations (if patching is delayed):
  • Restrict local logon and execution rights for low-privileged user accounts.
  • Tighten application controls to limit unauthorized software execution.
  • Monitor for any anomalous activity related to the BFS driver (bfs.sys) that could indicate attempted exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.