OnlyPatch
Microsoft Brokering File System

CVE-2025-53142 — Microsoft Brokering File System Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00351 🔬 Patch diffed 2025-08 archive

Executive Summary

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released Aug 12 2025
Last Updated Aug 12 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00351 — 0.28061 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00351
probability of exploitation in the next 30 days
0.28061 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

5 affected products
Product KB Article Severity Impact Restart Required
Windows 11 Version 22H2 for ARM64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5063875 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5063878 (Security Update) 5064010 (SecurityHotpatchUpdate) Important Elevation of Privilege 5062553 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.4946 10.0.26100.4851 Yes None Windows 11 Version 24H2 for x64-based Systems 5063878 (Security Update) 5064010 (SecurityHotpatchUpdate) Important Elevation of Privilege 5062553 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.4946 10.0.26100.4851 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5063899 (SecurityUpdate) Important Elevation of Privilege Yes

Patches

2 patches
Article Type Restart
5063875 Security Update Yes
5063899 SecurityUpdate Yes

Patch Diff

ghidriff · bfs.sys (KB5063878)

Use-after-free (CWE-416) in the Microsoft Brokering File System (bfs.sys), the kernel component that evaluates per-container storage policy for AppContainer/packaged apps - reachable from low-privileged/sandboxed callers, so a local EoP. BfsGetPolicyEntry looks up/builds a reference-counted policy entry (local_90) carrying a type tag at +0x38 (0x10000001 / 0x10000000) and an embedded object pointer at +0x28. Pre-patch it consumed the +0x28 pointer without validating the +0x38 type tag and dropped the entry's reference via BfsDereferencePolicyEntryEx UNCONDITIONALLY on a path where the entry was still live/returned - freeing it while in use -> UAF on the kernel-pool policy entry. IN-HOUSE ghidriff of bfs.sys 10.0.26100.4768 -> .4946 (Aug 12 2025) confirms the fix: gated behind CFR flag Feature_1122292024, BfsGetPolicyEntry now validates the type tag first (uses +0x28 only when +0x38 == 0x10000001, rejects other types with 0xc0000001 before use) and makes BfsDereferencePolicyEntryEx conditional so the entry isn't freed while still owned; BfsCreateStorage gets matching lifetime hardening. With the flag disabled the patched binary keeps the original unconditional-deref behaviour. Credit: ChenJian (Sea Security Orca Team); hazard.

Pre-patch version 10.0.26100.4768 Download
Post-patch version 10.0.26100.4946 Download
Function Address Change Note
BfsGetPolicyEntry code change code (type validation + conditional deref, CFR-gated) Pre: consumes *(lVar3+0x28) without validating the +0x38 type tag, then calls BfsDereferencePolicyEntryEx(local_90,0) unconditionally. Post (Feature_1122292024 enabled): if (*(int*)(lVar3+0x38)==0x10000001) use +0x28; else if (!=0x10000000) reject with 0xc0000001 (goto error); and the BfsDereferencePolicyEntryEx(local_90,0) call is made conditional so the entry isn't dropped while still in use - eliminating the UAF.
BfsCreateStorage code change code (lifetime hardening under same flag) Restructured under Feature_1122292024 with reordered checks / gotos around table-entry alloc/free (BfsAllocateTableEntry/BfsFreeTableEntry) to harden the storage-creation path alongside the policy-entry fix.
Feature_1122292024 new flag added (CFR gate) New Controlled Feature Rollout flag introduced by this patch; gates the type-validation and conditional-deref fix in BfsGetPolicyEntry (and BfsCreateStorage). Both branches ship in .4946.
View full diff report View RCA report

Attack Path

A Brokering File System policy entry is dereferenced (freed) while still in use, giving a use-after-free from a low-privileged caller

Attack path for CVE-2025-53142 A Brokering File System policy entry is dereferenced (freed) while still in use, giving a use-after-free from a low-privileged caller 01 — ENTRY Low-privileged / AppContainer process drives Brokering File System policy operations bfs.sys evaluates per-container storage policy for sandboxed/packaged apps; its policy path is reachable by low-privileged callers, making a memory-safety bug here a local EoP. 02 — CONTROLLED INPUT Requests a policy entry, reaching BfsGetPolicyEntry The entry (local_90) is a reference-counted object with a type tag at +0x38 (0x10000001/0x10000000) and an embedded object pointer at +0x28. 03 — PATH BfsGetPolicyEntry uses the entry's +0x28 pointer and drops its reference Pre-patch it consumes *(entry+0x28) without checking the +0x38 type tag, then calls BfsDereferencePolicyEntryEx(local_90,0), which drops a reference and frees the entry at zero. 04 — MISSING CHECK The reference is dropped unconditionally while the entry is still live The type tag isn't validated before the pointer use, and the dereference frees the policy entry on a path where it is still referenced/returned - a use-after-free (CWE-416) on the kernel-pool entry. 05 — PRIMITIVE UAF on the kernel policy entry -> elevation of privilege The freed policy entry is reclaimed via pool grooming and the dangling reference is reused, yielding controlled kernel corruption and SYSTEM. The Aug 2025 fix validates the type tag and makes the deref conditional - gated behind CFR flag Feature_1122292024.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

ChenJian with Sea Security Orca Team
hazard

On This Page