Microsoft Brokering File System contains a race condition due to improper synchronization of a shared resource. An attacker who already has access to the system can exploit this flaw to gain higher privileges locally, potentially reaching administrative rights. The vulnerability is a classic concurrency flaw (CWE-362) and also involves double‑free logic (CWE-415).

The flaw affects Windows 11 versions 24H2 and 25H2, as well as Windows Server 2025 including Server Core installations. These systems run on both ARM64 and x86 architectures as documented by the affected CPE strings.

The CVSS score of 7 indicates a medium‑to‑high severity. The EPSS score is listed as < 1 %, meaning the likelihood of exploitation in the wild is very low, and it is not currently present in the CISA KEV catalog. The attack vector is inferred to be local; an authorized user must execute the exploit from within the operating system, so remote exploitation is not described by the data. The combination of a moderate CVSS score and low EPSS suggests that the risk is manageable but should be mitigated promptly.