OnlyPatch
Microsoft Brokering File System

CVE-2025-29970 — Microsoft Brokering File System Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.0049 🔬 Patch diffed 2025-05 archive

Executive Summary

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released May 13 2025
Last Updated May 13 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.0049 — 0.39853 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.0049
probability of exploitation in the next 30 days
0.39853 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

1 affected product
Product KB Article Severity Impact Restart Required
Windows 11 Version 24H2 for ARM64-based Systems 5058411 (Security Update) 5058497 (SecurityHotpatchUpdate) Important Elevation of Privilege 5055523 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.4061 10.0.26100.3981 Yes None Windows 11 Version 24H2 for x64-based Systems 5058411 (Security Update) 5058497 (SecurityHotpatchUpdate) Important Elevation of Privilege 5055523 Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.4061 10.0.26100.3981 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5058384 (Security Update) Important Elevation of Privilege Yes

Patches

1 patch
Article Type Restart
5058384 Security Update Yes

Patch Diff

ghidriff · bfs.sys (KB5058411)

Patch diff 10.0.26100.3624 -> 10.0.26100.4061

Pre-patch version 10.0.26100.3624 Download
Post-patch version 10.0.26100.4061 Download
Function Address Change Note
wil_details_IsEnabledFallback 1c0003ff8 refcount, calling similarity 1.0
BfsCloseStorage 1c000e23c -> 1c000e320 code, length, address, called similarity 0.29
NTOSKRNL.EXE::ExFreePoolWithTag EXTERNAL:0000007a refcount, calling similarity 1.0
View full diff report View RCA report Download PoC

Attack Path

List head freed inside its own traversal loop - the second iteration dereferences it

Attack path for CVE-2025-29970 List head freed inside its own traversal loop - the second iteration dereferences it 01 — ENTRY Standard user triggers BFS storage teardown BfsCloseStorage runs on close of a Brokering File System storage object; reachable without elevation. 02 — CONTROLLED INPUT Attacker arranges a DirectoryBlockList with more than one node A single-node list never reaches the second iteration, so the number of directory blocks is what decides whether the bug fires. 03 — PATH The cleanup loop walks the list freeing as it goes for (dbl = obj->DirectoryBlockList; ; ExFreePoolWithTag(dbl, 0)) { currentNode = dbl->LinkedListEntry.Flink; ... } 04 — MISSING CHECK The loop increment frees the head, then the next iteration dereferences it ExFreePoolWithTag(directoryBlockList, 0) runs at the end of iteration 1; iteration 2 reads directoryBlockList->LinkedListEntry.Flink out of that freed block. The traversal pointer and the free target are the same object. 05 — PRIMITIVE Freed pool block read to obtain the next list pointer Whatever reclaims the block supplies the Flink, so the walk continues into attacker-influenced memory - kernel UAF from an ordinary close.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Microsoft Offensive Research & Security Engineering
hazard

On This Page