A use‑after‑free flaw in the Microsoft Brokering File System allows a malicious party to read or execute code in a memory area that has already been released, giving the attacker higher privileges on the machine. The weakness is listed as CWE‑416 and can lead to complete loss of control over the affected system by a local attacker.

The vulnerability applies to Microsoft Windows 11 versions 24H2, 25H2 and 26H1 and to Windows Server 2025, including Server Core installations. Both ARM64 and x64 architectures are affected for these operating systems.

With a CVSS score of 7.4 the flaw is rated high risk and an EPSS score of less than 1 % suggests it is unlikely to be widely exploited today. The likely attack vector is that an adversary must have local access and run malicious code that triggers the use‑after‑free in the file system; the vulnerability is not known to be exploitable remotely and is not listed in the CISA KEV catalog.