A critical race condition vulnerability in the Microsoft Brokering File System allows an unauthorized local attacker to elevate privileges, potentially resulting in full system compromise.

This flaw involves improper synchronization during concurrent execution, classified as a race condition (CWE-362) and use-after-free (CWE-416). It permits an unauthorized local attacker to manipulate shared resources to gain elevated system permissions.

The ability for an unauthorized local user to perform privilege escalation poses a significant risk to organizational integrity. Successful exploitation grants an attacker full control over the affected host, enabling data theft, the installation of malicious software, and lateral movement within the network. With a CVSS score of 8.4, this vulnerability is considered High severity, and it should be prioritized for remediation to prevent unauthorized system-level access.

Immediate Action: Deploy the official security updates provided by Microsoft for the affected Windows versions as detailed in the MSRC update guide.

Proactive Monitoring: Monitor system logs for unusual process creation, unexpected service behavior, or signs of unauthorized privilege escalation attempts by local users.

Compensating Controls: Ensure that principle of least privilege is strictly enforced for local user accounts to limit the potential impact if a local compromise occurs.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete system compromise via privilege escalation, administrators must prioritize the deployment of the vendor-supplied patches to all affected Windows endpoints. Organizations should verify that their patch management cycles are applied to the specific build versions identified in the enrichment data to ensure full coverage against this vulnerability.