OnlyPatch
Microsoft Brokering File System

CVE-2025-49677 — Microsoft Brokering File System Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00972 🔬 Patch diffed 2025-07 archive

Executive Summary

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released Jul 8 2025
Last Updated Jul 8 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00972 — 0.58903 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00972
probability of exploitation in the next 30 days
0.58903 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

2 affected products
Product KB Article Severity Impact Restart Required
Windows 11 Version 22H2 for ARM64-based Systems 5062552 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5062552 (Security Update) Important Elevation of Privilege Yes

Patches

1 patch
Article Type Restart
5062552 Security Update Yes

Patch Diff

ghidriff · bfs.sys (KB5062553)

Use-after-free (CWE-416) in the Microsoft Brokering File System driver bfs.sys policy-entry reference lifecycle, local EoP to SYSTEM (race, AC:H). bfs.sys stores per-user/per-container policy entries (tag EsfB) reference-counted (RefNo) in an RTL_DYNAMIC_HASH_TABLE, driven from \Device\Bfs IOCTL 0x228004 (BfsDeviceIoControl -> BfsProcessSetPolicyRequest -> BfsInsertPolicyEntry/BfsGetPolicyEntry/BfsDereferencePolicyEntryEx). The policy-entry RefNo lifecycle was not consistently paired with hash-table membership/lookups, so an entry (the EsfB pool block) could be freed (via BfsInsertPolicyEntry -> ExFreePoolWithTag on a dropped refcount) while a concurrent BfsProcessSetPolicyRequest/BfsGetPolicyEntry still looked it up/used it -> UAF (reporter observed a steadily reproducible bugcheck whose freed block was the EsfB policy entry). Diff of bfs.sys 10.0.26100.4484 -> .4652 (Jul 8 2025, KB5062553) confirms the July fix reworks the policy-entry reference lifecycle across BfsInsertPolicyEntry, BfsDereferencePolicyEntryEx, BfsInsertNotPresentPolicyEntry and BfsCheckAndApplyPolicy, all newly gated by CFR flag Feature_3148938554, so an entry is not freed while still referenced/looked up. AppSilo token required (BfsIsApplicableToken/SeAppSiloSid). MSRC: exploitation requires winning a race; grants SYSTEM. Note: our diff shows Feature_3148938554 (build/arch); paired double-free is CVE-2025-49693.

Pre-patch version 10.0.26100.4484 Download
Post-patch version 10.0.26100.4652 Download
Function Address Change Note
BfsInsertPolicyEntry / BfsDereferencePolicyEntryEx / BfsInsertNotPresentPolicyEntry / BfsCheckAndApplyPolicy code change code (policy-entry reference lifecycle rework, CFR-gated) Pre: EsfB policy-entry RefNo lifecycle not consistently paired with hash-table membership/lookups -> entry freed while concurrently referenced/looked up -> UAF. Post (Feature_3148938554): reference handling reworked so the entry is not freed while still referenced; local pointer copies nulled after ownership transfer (see CVE-2025-49693).
Feature_3148938554 gate added (CFR gate) CFR flag gating the policy-entry lifecycle rework; original path still ships when disabled.
View full diff report View RCA report

Attack Path

A BFS policy entry is freed while a concurrent SetPolicy lookup still uses it, yielding a UAF to SYSTEM

Attack path for CVE-2025-49677 A BFS policy entry is freed while a concurrent SetPolicy lookup still uses it, yielding a UAF to SYSTEM 01 — ENTRY AppSilo/AppContainer process issues BFS SetPolicy requests (\Device\Bfs IOCTL 0x228004) bfs.sys BfsProcessSetPolicyRequest manages EsfB policy entries reference-counted (RefNo) in a hash table. AV:L/PR:L, AC:H (race). 02 — CONTROLLED INPUT Concurrent SetPolicy operations on the same user/container policy entry One path drops the entry's reference/frees it while another is looking it up in the hash table. 03 — MISSING CHECK RefNo lifecycle not paired with hash-table membership/lookup (CWE-416) An EsfB policy entry is freed via BfsInsertPolicyEntry -> ExFreePoolWithTag while still reachable/used. 04 — PATH BfsGetPolicyEntry / BfsProcessSetPolicyRequest walks the table and uses the freed entry The dangling entry (or a double-dropped reference) is dereferenced after free. 05 — PRIMITIVE Use of the freed policy entry -> kernel UAF -> EoP to SYSTEM The Jul 2025 fix (Feature_3148938554) reworks the policy-entry reference lifecycle so entries are not freed while still referenced.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

ChenJian with Sea Security Orca Team

On This Page