Windows 11 and Windows Server 2025 high-severity vulnerability in Microsoft’s Brokering File System (BFS), identified as CVE-2026-50458, which allows for local privilege escalation on impacted systems.
The flaw is located in bfs.sys. This minifilter driver manages file, pipe, and registry access between sandboxed applications (like AppContainer and UWP apps) and the operating system.
This vulnerability, detailed by Rotce, affects Windows 11 versions 24H2, 25H2, and 26H1 on both x64 and ARM64 architectures, as well as Windows Server 2025, including Server Core installations, before specific patched builds.
The vulnerability arises from a use-after-free condition due to a race condition in BFS’s internal directory handling. When concurrent operations are executed on the same path, it can lead to kernel objects being freed while still in use, violating memory-safety guarantees.
Windows Brokering File System Vulnerability
Microsoft has classified this issue as an elevation-of-privilege vulnerability, assigning it a CVSS 3.1 score of 7.8, indicating a high-risk level.
To exploit CVE-2026-50458, an attacker must have local authenticated access, typically as a low-privileged user or by executing code in a sandboxed context.
By sending crafted IOCTL requests to the BFS device and misusing the policy-setting interface, an attacker can manipulate multiple threads through the vulnerable path, ultimately corrupting kernel memory and escalating privileges to SYSTEM.
According to Rotcee’s advisory on GitHub, the vulnerability stems from a race condition and use-after-free flaw, allowing attackers to gain full control of affected systems and compromise confidentiality, integrity, and availability.
Although BFS is designed to ensure strict isolation for sandboxed applications, exploiting this flaw compromises that separation. It allows an attacker to transition from a limited environment to full system control.
Telemetry and vendor analyses show that Windows 11 versions 24H2, 25H2, and 26H1 are vulnerable if they run builds earlier than 26100.8875, 26200.8875, and 28000.2269, respectively.
Windows Server 2025 is similarly at risk for builds below 26100.33158, making applications relying on sandboxing particularly vulnerable.
| Platform | Vulnerable Builds (Before) | Patch Build / Update | Severity |
|---|---|---|---|
| Windows 11 24H2 | < 26100.8875 | KB5101650 (July 2026) | High 7.8 |
| Windows 11 25H2 | < 26200.8875 | KB5101650 (July 2026) | High 7.8 |
| Windows 11 26H1 | < 28000.2269 | July 2026 CU | High 7.8 |
| Windows Server 2025 | < 26100.33158 | July 2026 CU | High 7.8 |
As of now, no confirmed instances of exploitation or ransomware using CVE-2026-50458 have been reported, and it does not appear on CISA’s Known Exploited Vulnerabilities list.
Nonetheless, the vulnerability’s kernel-level nature and the prevalence of Windows 11 and Server 2025 in enterprise environments necessitate urgent attention from security teams.
Microsoft released a fix for this vulnerability in the July 14, 2026 Patch Tuesday update, included in cumulative update KB5101650 for Windows 11 versions 24H2 and 25H2, with corresponding updates for 26H1 and Windows Server 2025.
Organizations should assess their systems running Windows 11 or Server 2025, check build numbers against vulnerable ranges, and integrate the July 2026 security updates into their patching schedules.
In situations where immediate updates are delayed, security teams should restrict local logon and execution rights for low-privileged accounts, tighten application controls, and monitor for anomalies in BFS driver activity until remediation is implemented.
