OnlyPatch
Windows Brokering File System

CVE-2026-50458 — Microsoft Brokering File System Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00188 🔬 Patch diffed 2026-07 archive

Executive Summary

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-416: Use After Free
Released Jul 14 2026
Last Updated Jul 14 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00188 — 0.08626 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00188
probability of exploitation in the next 30 days
0.08626 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

8 affected products
Product KB Article Severity Impact Restart Required
Windows 11 Version 24H2 for ARM64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for x64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for ARM64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 25H2 for x64-based Systems 5101650 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 26H1 for ARM64-based Systems 5101649 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5095051 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 5099536 (Security Update) Important Elevation of Privilege Yes
Windows Server 2025 (Server Core installation) 5099536 (Security Update) Important Elevation of Privilege Yes

Patches

4 patches
Article Type Restart
5101650 Security Update Yes
5101649 Security Update Yes
5095051 Security Update Yes
5099536 Security Update Yes

Patch Diff

ghidriff · bfs.sys (KB5101650)

Patch diff 10.0.26100.8521 -> 10.0.26100.8875

Pre-patch version 10.0.26100.8521 Download
Post-patch version 10.0.26100.8875 Download
Function Address Change Note
__GSHandlerCheck 140015be8 -> 140016298 refcount, address similarity 1.0
BfsPreCleanupOperation 140002450 -> 140002430 code, refcount, length, address, called similarity 0.38
BfsRegistryPreCreateCallback 140010fc8 -> 140011310 code, length, sig, address, called similarity 0.12
BfsProcessDelete 14000eaa0 -> 14000f100 code, length, address, called similarity 0.39
wil_details_IsEnabledFallback 1400052c4 -> 1400054ec refcount, address, calling similarity 1.0
NTOSKRNL.EXE::PsDereferencePrimaryToken EXTERNAL:0000007b -> EXTERNAL:0000007c refcount, address, calling similarity 1.0
BfsInsertDirectoryEntry 140014220 -> 14001436c code, length, sig, address, called similarity 0.78
BfsAllocateBlock 140012798 -> 140012948 refcount, address, calling similarity 1.0
BfsCheckAndReleaseIdlePolicy 1400062a4 -> 140006510 code, length, address, called similarity 0.22
BfsInsertPolicyEntryLocked 140008f30 -> 140009268 code, length, address, called similarity 0.71
DriverEntry 140021078 code, length, called similarity 0.83
NTOSKRNL.EXE::RtlPrefixUnicodeString EXTERNAL:00000034 -> EXTERNAL:00000035 refcount, address similarity 1.0
BfsProcessSetPolicyRequest 14000ab30 -> 14000aecc code, length, address, called similarity 0.54
NTOSKRNL.EXE::ExAcquirePushLockExclusiveEx EXTERNAL:00000012 refcount, calling similarity 1.0
NTOSKRNL.EXE::ZwOpenFile EXTERNAL:00000066 -> EXTERNAL:00000067 refcount, address, calling similarity 1.0
FLTMGR.SYS::FltParseFileNameInformation EXTERNAL:000000b4 -> EXTERNAL:000000b6 refcount, address, calling similarity 1.0
BfsGetFileName 140007360 -> 1400075f0 refcount, address, calling similarity 1.0
NTOSKRNL.EXE::PsReferencePrimaryToken EXTERNAL:00000082 -> EXTERNAL:00000083 refcount, address, calling similarity 1.0
NTOSKRNL.EXE::ExAcquireRundownProtection EXTERNAL:00000086 -> EXTERNAL:0000008f refcount, address, calling similarity 1.0
NTOSKRNL.EXE::ExAcquirePushLockSharedEx EXTERNAL:0000001b refcount, calling similarity 1.0
BfsRegistryPostCreateCallback 140010dc8 -> 140011118 code, length, address, called similarity 0.6
BfsInitializeGlobalFileTable 14000dedc -> 14000e55c code, length, address, called similarity 0.8
BfsReleaseNamedPipeMapping 14000cef4 -> 14000d624 code, length, address, called similarity 0.39
BfsPostCleanupOperation 140001780 code, length, called similarity 0.96
NTOSKRNL.EXE::RtlClearBits EXTERNAL:00000046 -> EXTERNAL:00000047 refcount, address, calling similarity 1.0
BfsIdleCheckWorkitemRoutine 140007fd0 -> 140008300 code, length, address, called similarity 0.47
__security_check_cookie 140015de0 -> 140016490 refcount, address, calling similarity 1.0
NTOSKRNL.EXE::RtlQueryPackageIdentity EXTERNAL:0000003d -> EXTERNAL:0000003e refcount, address, calling similarity 1.0
BfsRegistryCallback 1400010c0 refcount similarity 0.87
BfsGetPolicy 1400076cc -> 1400079a4 code, refcount, length, address, calling, called similarity 0.43
NTOSKRNL.EXE::RtlFindClearBits EXTERNAL:00000043 -> EXTERNAL:00000044 refcount, address, calling similarity 1.0
memset 140016200 -> 140016880 refcount, address, calling similarity 1.0
NTOSKRNL.EXE::ZwClose EXTERNAL:00000070 -> EXTERNAL:00000071 refcount, address, calling similarity 1.0
NTOSKRNL.EXE::RtlConvertSidToUnicodeString EXTERNAL:00000018 refcount, calling similarity 1.0
NTOSKRNL.EXE::KeEnterCriticalRegion EXTERNAL:00000085 -> EXTERNAL:00000088 refcount, address, calling similarity 1.0
BfsAddOrModifyEntry 1400124fc -> 14001267c code, length, sig, address, called similarity 0.24
BfsCheckPolicyAndPerformRenameAsUser 1400064dc -> 14000669c code, length, sig, address, called similarity 0.13
BfsRemoveKeyValues 1400114f4 -> 140011794 code, length, address, called similarity 0.94
BfsInsertNotPresentPolicyEntry 140008180 -> 140008498 code, length, address, called similarity 0.47
FLTMGR.SYS::FltReleaseFileNameInformation EXTERNAL:00000096 -> EXTERNAL:00000097 refcount, address, calling similarity 1.0
BfsRenameEntry 140014a30 -> 140015064 code, length, address, called similarity 0.42
NTOSKRNL.EXE::RtlInitializeBitMap EXTERNAL:00000048 -> EXTERNAL:00000049 refcount, address, calling similarity 1.0
_tlgWriteTransfer_EtwWriteTransfer 140001008 refcount, calling similarity 1.0
NTOSKRNL.EXE::CmRegisterCallbackEx EXTERNAL:00000005 -> EXTERNAL:00000007 refcount, address similarity 1.0
BfsInsertPolicyEntry 140008750 -> 140008a54 code, length, sig, address, called similarity 0.09
BfsCreateStorage 140012d94 -> 140012f40 code, length, address, called similarity 0.98
BfsWriteBlock 14001505c -> 1400156b4 refcount, address, calling similarity 1.0
BfsPostCreateOperation 140001af0 -> 140001ae0 code, length, address, called similarity 0.87
BfsPreCreatePipeOperation 140003090 -> 140002f30 code, length, address, called similarity 0.41
BfsCalculateRegistryPrefix 1400103d8 -> 140010a28 refcount, address, calling similarity 1.0
BfsPreCreateOperation 140002790 -> 140002730 code, length, address, called similarity 0.23
NTOSKRNL.EXE::PsReferenceImpersonationToken EXTERNAL:00000083 -> EXTERNAL:00000084 refcount, address, calling similarity 1.0
BfsGetNotPresentPolicyEntryLocked 140007568 -> 140007828 code, length, address, called similarity 0.8
NTOSKRNL.EXE::RtlSetBits EXTERNAL:00000044 -> EXTERNAL:00000045 refcount, address, calling similarity 1.0
FLTMGR.SYS::FltGetDestinationFileNameInformation EXTERNAL:000000b5 refcount, calling similarity 1.0
NTOSKRNL.EXE::ExFreePoolWithTag EXTERNAL:0000007e -> EXTERNAL:0000007f refcount, address, calling similarity 1.0
BfsIsApplicableToken 140001280 refcount, calling similarity 1.0
NTOSKRNL.EXE::KeLeaveCriticalRegion EXTERNAL:00000087 -> EXTERNAL:00000090 refcount, address, calling similarity 1.0
BfsExpandDirectory 14001384c -> 1400139ec code, refcount, length, address, calling, called similarity 0.75
BfsCheckAndApplyPolicy 140005c68 -> 140005e98 code, length, address, called similarity 0.35
NTOSKRNL.EXE::ExReleaseRundownProtection EXTERNAL:0000007d -> EXTERNAL:0000007e refcount, address, calling similarity 1.0
NTOSKRNL.EXE::RtlFreeUnicodeString EXTERNAL:0000006e -> EXTERNAL:0000006f refcount, address, calling similarity 1.0
BfsPreSetInfoOperation 140004200 -> 140004030 code, length, sig, address, called similarity 0.8
BfsDeviceIoControl 140003670 -> 1400034d0 code, length, address, called similarity 0.9
BfsProcessRename 1400042b0 -> 140004554 code, length, sig, address, called similarity 0.69
NTOSKRNL.EXE::RtlInitUnicodeString EXTERNAL:00000067 -> EXTERNAL:00000068 refcount, address, calling similarity 1.0
Feature_BfsFixBundle__private_IsEnabledDeviceUsageNoInline 1400049b4 -> 140004b88 refcount, address, calling similarity 1.0
BfsDereferencePolicyEntryEx 1400067d0 -> 140006a64 refcount, address, calling similarity 1.0
BfsCreateDirectory 1400129d8 -> 140012b88 code, length, address, called similarity 0.53
BfsGetPolicyEntryLocked 140007b40 -> 140007e4c code, length, address, called similarity 0.56
BfsGetRegistryPrefix 14001075c -> 140010dac code, length, address, called similarity 0.93
NTOSKRNL.EXE::ExAllocatePool2 EXTERNAL:00000084 -> EXTERNAL:00000087 refcount, address, calling similarity 1.0
BfsGetNotPresentPolicyEntry 140007468 -> 1400076f8 code, refcount, length, address, calling, called similarity 0.79
BfsFreeBlock 140013c08 -> 140013dbc refcount, address, calling similarity 1.0
NTOSKRNL.EXE::PsDereferenceImpersonationToken EXTERNAL:0000007c -> EXTERNAL:0000007d refcount, address, calling similarity 1.0
NTOSKRNL.EXE::IoGetCurrentProcess EXTERNAL:00000081 -> EXTERNAL:00000082 refcount, address, calling similarity 1.0
BfsCreatePolicyStorageDescriptor 1400152b8 -> 140015910 code, length, address, called similarity 0.39
BfsPostCreatePipeOperation 140003ef0 -> 140003d30 code, length, address, called similarity 0.87
BfsInsertDirectory 140013f90 -> 140014140 code, length, address, called similarity 0.28
memcpy 140015f00 -> 140016580 name, fullname, refcount, sig, address, calling similarity 1.0
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 140004768 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 140004768 -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 140004768 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 140004768 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 140004768 -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 140004768 -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 140004768 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 140004768 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 140004768 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 140004768 -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 1400047bc -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 1400047bc -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 1400047bc -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 1400047bc -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 1400047bc -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 1400047bc -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 1400047bc -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 1400047bc -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 1400047bc -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 1400047bc -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 14000c2b8 -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 14000c30c -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14000c30c -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 14000c30c -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 14000c30c -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 14000c30c -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 14000c30c -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 14000c30c -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 14000c360 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 14000c360 -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14000c360 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 14000c360 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 14000c360 -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 14000c360 -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 14000c360 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 14000c360 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 14000c360 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 14000c360 -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 14000c3b4 -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 14000d1a4 -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 14000f5d0 -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14000f5d0 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 14000f5d0 -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 14000f5d0 -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 14000f5d0 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 14000f5d0 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 14000f5d0 -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 14001170c -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14001170c -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 14001170c -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 14001170c -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 14001170c -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 14001170c -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 14001170c -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 140011760 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 140011760 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 140011760 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 140011760 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 140011760 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 140011760 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 1400117b4 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 1400117b4 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 1400117b4 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 1400117b4 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 1400117b4 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 1400117b4 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_2191465787__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 14000c994 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsRenameSourceCheck__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 14000cb38 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsVolumeRootPolicy__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 14000cb8c name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_217306426__private_IsEnabledDeviceUsageNoInline 1400150f8 -> 140015e70 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsHardLinkDeny__private_IsEnabledDeviceUsageNoInline 14001514c -> 140004bdc name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_241429816__private_IsEnabledDeviceUsageNoInline 14001514c -> 14000c9e8 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsProcessAppxReparse__private_IsEnabledDeviceUsageNoInline 14001514c -> 14000cae4 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_474460473__private_IsEnabledDeviceUsageNoInline 14001514c -> 14000fc24 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_3879979322__private_IsEnabledDeviceUsageNoInline 14001514c -> 140015750 name, fullname, refcount, sig, address, calling, called similarity 0.71
Feature_BfsDirMoveBlockLeak__private_IsEnabledDeviceUsageNoInline 14001514c -> 1400157a4 name, fullname, refcount, sig, address, calling, called similarity 0.71
BfsGetRegistryPrefix 140010ad0 -> 140010dac code, name, fullname, refcount, length, sig, address, called similarity 0.13
View full diff report View RCA report Download PoC

Attack Path

Broken refcount contract in the BFS directory cache - duplicate inserts hand out a pointer without taking a reference

Attack path for CVE-2026-50458 Broken refcount contract in the BFS directory cache - duplicate inserts hand out a pointer without taking a reference Racing threads BFS directory cache Cache entry (+0x98 refcount) N threads miss BfsLocateDirectory("X") and race into BfsInsertDirectory 1 bfs.sys is the Brokering File System minifilter. Any standard user can drive the directory cache; four or more synchronized threads make the race practical. RtlInsertElementGenericTableAvl returns the existing entry for all but the first thread 2 The contract in this cache is strict: any function returning entry+8 with success must hold a refcount for the caller. BfsLocateDirectory honours it with lock inc [rax+98h]. The duplicate branch publishes entry+8 but skips InterlockedIncrement(&entry->RefCount) 3 The duplicate test checks the wrong thing: `pNewElement == NULL` compares the ADDRESS, which is never NULL here, instead of the VALUE `*pNewElement == false`. So the ref++ lands only on real inserts while every racing thread still receives entry+8. Each racing thread later calls BfsDereferenceTableEntry(oldDir-8) 4 BfsAddOrModifyEntry blindly dereferences after every BfsCreateDirectory, relying on the contract that was just broken. Refcount is decremented more times than it was incremented 5 Each late thread consumes a reference that was never taken, driving the count to zero while the entry is still published and in use. Cache entry freed while still referenced - kernel pool UAF 6 Reported by rotcee with a working PoC. Patch fixes the duplicate test so the reference is taken on every path that returns entry+8.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

anonymous

On This Page