CVE-2025-21372 Overview
CVE-2025-21372 is an elevation of privilege vulnerability in the Microsoft Brokering File System affecting Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025. The flaw is rooted in a use-after-free condition [CWE-416] within the Brokering File System component. A local, low-privileged attacker can leverage the flaw to gain SYSTEM-level privileges on affected hosts. Microsoft rates the issue as important with a CVSS 3.1 score of 7.8. The CVSS vector indicates a scope change, meaning successful exploitation impacts resources beyond the initially compromised security boundary.
Critical Impact
Successful exploitation grants an authenticated local attacker SYSTEM privileges, enabling full control of the host including credential theft, persistence, and lateral movement.
Affected Products
- Microsoft Windows 11 24H2
- Microsoft Windows Server 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2025-01-14 - CVE-2025-21372 published to NVD alongside Microsoft's January 2025 Patch Tuesday release
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21372
Vulnerability Analysis
The vulnerability affects the Windows Brokering File System, a kernel-mode component that mediates file access requests between processes and the underlying file system. Microsoft's advisory and the assigned CWE-416 classification indicate a use-after-free condition in this component. When triggered, the driver dereferences memory that has already been released, allowing an attacker to influence the freed allocation and redirect execution or manipulate privileged kernel structures.
The attack requires local access and low privileges but carries high attack complexity, reflecting the need to win a timing window or manipulate object lifecycles precisely. The CVSS scope change indicates that a successful exploit crosses a security boundary, elevating a standard user context to SYSTEM. The EPSS model currently rates the probability of observed exploitation activity as low, but historical trends show that Windows kernel use-after-free bugs are frequently weaponized in post-compromise privilege escalation chains.
Root Cause
The root cause is improper object lifetime management inside the Brokering File System driver. A referenced object is freed while another code path still holds and later reuses a pointer to that object, producing the classic use-after-free primitive documented in [CWE-416].
Attack Vector
An attacker must first obtain local code execution as a low-privileged user, typically through phishing, a browser exploit, or an initial-access payload. From that context, the attacker issues crafted requests to the Brokering File System interface to trigger the freed-object reuse. Reliable exploitation generally involves heap grooming and precise race timing to shape the reclaimed allocation before the dangling pointer is used.
The vulnerability mechanism is described in the Microsoft Security Update CVE-2025-21372 advisory. No public proof-of-concept code has been released.
Detection Methods for CVE-2025-21372
Indicators of Compromise
- Unexpected token elevation or SYSTEM-context child processes spawned from standard-user parent processes.
- Crash dumps or WerFault.exe events referencing the Brokering File System driver, which may indicate failed exploitation attempts.
- New services, scheduled tasks, or driver installations created immediately after a low-privileged process performs unusual I/O against broker interfaces.
Detection Strategies
- Hunt for processes that transition from a medium or low integrity level to SYSTEM without a corresponding UAC or service-control code path.
- Correlate Windows Error Reporting entries for the Brokering File System driver with subsequent privileged process creations from the same user session.
- Alert on unsigned or untrusted binaries executing from user-writable paths that quickly gain SYSTEM privileges.
Monitoring Recommendations
- Enable Sysmon Event ID 1 (process creation), Event ID 10 (process access), and Event ID 25 (process tampering) to capture integrity-level transitions.
- Ingest Windows Security event 4672 (special privileges assigned) and 4688 (process creation with token elevation) into your SIEM.
- Track kernel crash telemetry and driver-load events on Windows 11 24H2 and Windows Server 2022/2025 hosts until patches are confirmed applied.
How to Mitigate CVE-2025-21372
Immediate Actions Required
- Apply the January 2025 Microsoft security update referenced in the MSRC advisory to all Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025 systems.
- Prioritize patching on multi-user hosts, jump servers, and terminal servers where local users can execute code.
- Audit local account membership and remove unnecessary interactive logon rights on servers and privileged workstations.
Patch Information
Microsoft addressed CVE-2025-21372 in the January 14, 2025 Patch Tuesday cumulative updates for Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025. Refer to the Microsoft Security Update CVE-2025-21372 advisory for KB article numbers and download links matching your build.
Workarounds
- No official Microsoft workaround exists; applying the security update is the supported remediation.
- Enforce least-privilege policies and application allow-listing to reduce the pool of users who can stage local exploit code.
- Deploy an EDR solution capable of identifying use-after-free exploitation behavior and blocking unauthorized token manipulation until patching is complete.
# Verify the January 2025 cumulative update is installed on affected Windows hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Confirm build revision meets or exceeds the patched Windows 11 24H2 baseline
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
