CVE-2025-62469CWE-362CWE-415

CVE-2025-62469

High · published December 9, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

⚡ A race condition in the Microsoft Brokering File System could let a savvy attacker leap from authorized to elevated privileges faster than you can say 'whoops!' 🏃‍♂️💨 Think of it as a restaurant where two chefs are trying to prepare the same dish at the same time — if they don’t communicate properly, one might sneak in and change the recipe before it’s served, leading to an unexpected and possibly disastrous outcome! This vulnerability could allow an attacker to gain elevated privileges on the local system, giving them the power to manipulate files, settings, and potentially wreak havoc on the entire system. Imagine someone walking in as a regular customer but leaving as the head chef — that’s the level of access they could gain!

Put simply

Think of it as a restaurant where two chefs are trying to prepare the same dish at the same time — if they don’t communicate properly, one might sneak in and change the recipe before it’s served, leading to an unexpected and possibly disastrous outcome! This race condition occurs due to improper synchronization when multiple processes try to access shared resources, allowing an attacker with local access to exploit this flaw and gain higher privileges than intended.

What to do

This vulnerability could allow an attacker to gain elevated privileges on the local system, giving them the power to manipulate files, settings, and potentially wreak havoc on the entire system. Imagine someone walking in as a regular customer but leaving as the head chef — that’s the level of access they could gain! To mitigate this issue, ensure that you apply the latest patches from Microsoft as soon as they become available. Additionally, review user access controls to minimize exposure and limit the potential for unauthorized privilege escalation. You've got this! Stay proactive and secure your systems, and you’ll keep those digital kitchens running smoothly! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.2th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-415 · Double Free
Published
2025-12-09T23:15Z
Affected products (3)
ProductVersionsFixed in
microsoft/windows_11_24h2< 10.0.26100.739210.0.26100.7392
microsoft/windows_11_25h2< 10.0.26200.739210.0.26200.7392
microsoft/windows_server_2025< 10.0.26100.739210.0.26100.7392
References (1)
EPSS history
Timeline
  • 09 DEC 17:55Z
    Microsoft Brokering File System Elevation of Privilege Vulnerability
    cvelistv5