CVE-2026-50458

Published Jul 14, 2026

Last updated 2 months ago

Microsoft Brokering File System

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-50458 is a use-after-free vulnerability found within the Microsoft Brokering File System (BFS), specifically impacting the `bfs.sys` Windows kernel minifilter driver. This flaw allows an authorized local attacker to elevate privileges on an affected Windows host. The vulnerability arises from a race condition during concurrent operations on BFS objects, where a kernel object can be freed while still being referenced by another thread, leading to a use-after-free condition. Exploitation of CVE-2026-50458 can enable an attacker to achieve arbitrary code execution and gain full control over the compromised system, impacting confidentiality, integrity, and availability. Affected systems include various versions of Windows 11 (24H2, 25H2, and 26H1) and Windows Server 2025. Microsoft released an advisory and corresponding patches for this vulnerability on July 14, 2026.

Description: Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_11_24h2, windows_11_25h2, windows_11_26h1, windows_server_2025

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-362

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "6D55C01A-5908-4CFC-BEB6-BBF3B6F0C5AF",
            "versionEndExcluding": "10.0.26100.8875",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "740B730D-AEC5-4735-A122-B1CF8B3C364C",
            "versionEndExcluding": "10.0.26100.8875",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "E26E96B6-1469-46AE-9CB5-AB7A0372C398",
            "versionEndExcluding": "10.0.26200.8875",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "DDBCA9E4-7BFB-423A-B7A7-9CBF5625053D",
            "versionEndExcluding": "10.0.26200.8875",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "8967AF79-CAD0-4F87-85A5-95D031C9FEFA",
            "versionEndExcluding": "10.0.28000.2269",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "8E90830B-0BD1-4D01-9C7D-0F0E1828A0F5",
            "versionEndExcluding": "10.0.28000.2525",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "22BE2FE9-37B9-4FF2-B43A-60A3518E0F08",
            "versionEndExcluding": "10.0.26100.33158",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.