Microsoft Brokering File System contains a use‑after‑free flaw that an authorized local user can exploit to gain elevated privileges. The vulnerability, identified as CWE‑416, permits the attacker to access or execute memory that has already been freed, potentially allowing the execution of malicious code with higher privileges. Because the flaw resides in the kernel‑level file‑system component, the impact is confined to the compromised machine and requires no network access.

The flaw affects Microsoft Windows 11 operating systems released as versions 24H2, 25H2, and 26H1, as well as Microsoft Windows Server 2025, including the Server Core installation. These releases are identified by the vendor and product names and their associated version numbers in the provided list.

The CVSS score of 7.0 indicates a moderate severity rating, while the EPSS score of less than 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, requiring an authorized user to trigger the use‑after‑free within the brokering file system to elevate privileges.