Use‑after‑free in the Microsoft Brokering File System module can be triggered by an authorized local user to corrupt memory and obtain elevated privileges on the affected systems. The flaw, classified as CWE‑416, permits an attacker who can already access the device to execute arbitrary code with higher authority, compromising confidentiality, integrity, and availability of the local machine.

The vulnerability affects Microsoft Windows 11 24H2 and 25H2, Windows Server 2022 23H2 edition (Server Core), and Windows Server 2025, including its Server Core installation. The specific product names and version numbers are listed by the Microsoft Security Response Center and correspond to the CPE entries for arm64 and x86 variants.

With a CVSS score of 7 the flaw is considered a high severity issue, but the EPSS score of less than 1% indicates a very low probability of exploitation at this time. The vulnerability is not included in CISA’s KEV catalog. Exploitation requires local access and a privileged context; an attacker who can run code on the machine can trigger the use‑after‑free to elevate to system level. Because it is local, the attack surface is limited to users who already have local login rights.