CVE-2025-29970

Published May 13, 2025

Last updated 7 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-29970 is a use-after-free vulnerability in the Microsoft Brokering File System (BFS) driver, specifically affecting the bfs.sys component. The vulnerability stems from improper memory management in the deallocation logic of BFS's DirectoryBlockList, where the head of a linked list is deallocated prematurely while the function continues to access the freed memory in subsequent iterations. This occurs in the BfsCloseStorage function when policies are removed via the BfsProcessDeletePolicyRequest IOCTL call. An attacker with local access and appropriate tokens could exploit this vulnerability to escalate privileges on a Windows system. Exploitation requires the attacker to impersonate a process with an AppSilo token and create policy entries within the system. The vulnerability affects systems that use Windows sandbox features, particularly those that deploy isolated applications.

Description: Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_11_24h2, windows_server_2022_23h2, windows_server_2025

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-416

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "vulnerable": true,
            "matchCriteriaId": "4448191F-2152-4E7F-8D4A-4EE7ED6657D6",
            "versionEndExcluding": "10.0.26100.4061"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "vulnerable": true,
            "matchCriteriaId": "7CE8E58A-59AA-4649-8C0F-0DB11A1D1936",
            "versionEndExcluding": "10.0.26100.4061"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B9B2720-3733-4C50-85F7-156D781D15B8",
            "versionEndExcluding": "10.0.25398.1611"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DAE51E4F-FCFF-4DC0-9B76-861EE20D54A4",
            "versionEndExcluding": "10.0.26100.4061"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.