VDB
CVE-2025-54105
CVE-2025-54105
PUBLISHED
CVSS 7 HIGH
Microsoft Brokering File System Elevation of Privilege Vulnerability
Reported by microsoft · Published September 9, 2025
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
Risk scores
CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 |
| Microsoft | Windows Server 2025 | 10.0.26100.0 |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 |
| microsoft | windows_server_2025 | 10.0.26100.0 |
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 |
| microsoft | windows_11_24H2 | 10.0.26100.0 |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 |
| Microsoft | Windows Server 2025 | 10.0.26100.0 |
| microsoft | windows_server_23h2 | 10.0.25398.0 |
| Microsoft | Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.0 |
Timeline
- Sep 9, 2025 CVE Published
- Sep 9, 2025 Coalition ESS Score (10 in total, the first dated here)
- Sep 10, 2025 EPSS Score (30 in total, the first dated here)
- Dec 10, 2025 CVE Updated
- Mar 11, 2026 Security Advisory (63 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-54105
vulnetix vdb fixes CVE-2025-54105Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-54105/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- Microsoft Brokering File System Elevation of Privilege Vulnerability vendor-advisorypatch