OnlyPatch
Microsoft Brokering File System

CVE-2025-54105 — Microsoft Brokering File System Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00282 🔬 Patch diffed 2025-09 archive

Executive Summary

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Released Sep 9 2025
Last Updated Sep 9 2025
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00282 — 0.20599 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00282
probability of exploitation in the next 30 days
0.20599 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

1 affected product
Product KB Article Severity Impact Restart Required
Windows 11 Version 24H2 for ARM64-based Systems 5065426 (Security Update) 5065474 (SecurityHotpatchUpdate) Important Elevation of Privilege 5063878 5064010 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.6584 10.0.26100.6508 Yes None Windows 11 Version 24H2 for x64-based Systems 5065426 (Security Update) 5065474 (SecurityHotpatchUpdate) Important Elevation of Privilege 5063878 5064010 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.6584 10.0.26100.6508 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5065425 (Security Update) Important Elevation of Privilege Yes

Patches

1 patch
Article Type Restart
5065425 Security Update Yes

Patch Diff

ghidriff · bfs.sys (KB5065426)

Race condition (CWE-362) in the Microsoft Brokering File System (bfs.sys), reachable from low-privileged/AppContainer callers -> local EoP. BfsCheckAndReleaseIdlePolicy walks the policy set and releases idle reference-counted policy entries (BfsDereferencePolicyEntryEx) while holding only a SHARED push-lock (ExAcquirePushLockSharedEx). Because a shared lock allows concurrent holders, two threads can observe the same entry as idle and both drop its reference (or mutate the policy list simultaneously) - a race that double-releases/frees a policy entry still in use, i.e. a race-based use-after-free. IN-HOUSE ghidriff of bfs.sys 10.0.26100.4946 -> .6584 (Sep 9 2025) confirms the fix: gated behind CFR flag Feature_3434922298, the lock is upgraded from shared to EXCLUSIVE (ExAcquirePushLockExclusiveEx) so only one thread performs the check-and-release at a time, closing the race window. With the flag disabled the patched binary still takes the shared lock. This is the race sibling of CVE-2025-53142 (bfs.sys policy-entry UAF, Aug 2025, Feature_1122292024, same reporter). Credit: ChenJian (Sea Security Orca Team).

Pre-patch version 10.0.26100.4946 Download
Post-patch version 10.0.26100.6584 Download
Function Address Change Note
BfsCheckAndReleaseIdlePolicy code change (only changed function) code (shared->exclusive push-lock upgrade, CFR-gated) Pre: KeEnterCriticalRegion(); ExAcquirePushLockSharedEx(param_1,0) around the walk that calls BfsDereferencePolicyEntryEx on idle entries. Post (Feature_3434922298 enabled): ExAcquirePushLockExclusiveEx(param_1,0) instead of shared, with the release/iteration restructured under the exclusive lock. Serializes the idle-policy check-and-release so concurrent threads can no longer race the same entry's release.
Feature_3434922298 new flag added (CFR gate) New Controlled Feature Rollout flag introduced by this patch; selects the exclusive-lock (fixed) path in BfsCheckAndReleaseIdlePolicy. Both shared and exclusive branches ship in .6584.
View full diff report View RCA report

Attack Path

Idle Brokering File System policy entries are released under a shared lock, so two threads can race the same release

Attack path for CVE-2025-54105 Idle Brokering File System policy entries are released under a shared lock, so two threads can race the same release 01 — ENTRY Low-privileged / AppContainer process drives concurrent Brokering File System policy operations bfs.sys evaluates per-container storage policy for sandboxed apps; its policy path is reachable by low-privileged callers. The attacker issues parallel policy activity to create a race. 02 — CONTROLLED INPUT Multiple threads reach BfsCheckAndReleaseIdlePolicy for the same idle entry The idle-reclamation routine walks the policy set and releases entries that have gone idle via BfsDereferencePolicyEntryEx (reference drop / free at zero). 03 — PATH The walk-and-release runs under a SHARED push-lock ExAcquirePushLockSharedEx(param_1,0) is a reader lock - it does not exclude other shared holders, so two threads execute the release path concurrently. 04 — MISSING CHECK Check ('is idle?') and action ('release') are not atomic across threads Two threads observe the same entry as idle and both call BfsDereferencePolicyEntryEx (or mutate the list simultaneously) - a CWE-362 race that double-releases/frees a policy entry still in use. 05 — PRIMITIVE Race-based use-after-free of the policy entry -> elevation of privilege Winning the race frees a policy entry another thread still uses; pool grooming turns the dangling reference into controlled kernel corruption and SYSTEM. The Sep 2025 fix upgrades the lock to exclusive (ExAcquirePushLockExclusiveEx) - gated behind CFR flag Feature_3434922298.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

ChenJian with Sea Security Orca Team

On This Page