CVE-2025-54105: Windows 11 24h2 Privilege Escalation Flaw

CVE-2025-54105 Overview

CVE-2025-54105 is a race condition vulnerability in the Microsoft Brokering File System that allows an authorized local attacker to elevate privileges on affected Windows systems. The flaw stems from concurrent execution using a shared resource with improper synchronization [CWE-362]. Successful exploitation grants the attacker higher privileges than initially assigned, potentially reaching SYSTEM-level access. The vulnerability affects current Windows 11 and Windows Server platforms, requiring local access and low privileges but high attack complexity due to the timing-sensitive nature of race condition exploitation.

Critical Impact
An authorized local attacker who wins the race condition can elevate privileges on the host, gaining full confidentiality, integrity, and availability impact on the target system.

Affected Products

Microsoft Windows 11 24H2
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-09-09 - CVE-2025-54105 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54105

Vulnerability Analysis

The vulnerability resides in the Microsoft Brokering File System, a Windows component that brokers file system operations between processes with differing trust levels. The issue is classified under [CWE-362], concurrent execution using a shared resource with improper synchronization. When multiple threads or processes interact with the same file system resource, the broker fails to enforce atomic access, creating a narrow exploitation window.

An attacker with valid local credentials can invoke operations that trigger the broker to act on a shared resource. By racing another thread that modifies the resource state between the check and use, the attacker manipulates the broker into performing privileged operations on attacker-controlled objects.

The attack requires local access and a low-privileged user context. Because the vulnerability affects a Windows broker running at elevated privilege, successful exploitation results in full compromise of the local system across confidentiality, integrity, and availability.

Root Cause

The root cause is missing or insufficient locking around shared file system state in the Brokering File System. The broker performs a validation step and a subsequent action without holding an exclusive lock, allowing a concurrent operation to alter the resource state between those two events. This time-of-check to time-of-use (TOCTOU) pattern is characteristic of [CWE-362] race conditions.

Attack Vector

Exploitation requires local code execution as a standard user. The attacker launches two or more threads: one invokes a brokered file operation, and another modifies the target path or handle. Winning the race causes the elevated broker to operate on the substituted object, yielding privileged file writes or handle duplication that the attacker converts into code execution as SYSTEM. Because attack complexity is high, reliable exploitation typically requires multiple attempts and careful timing.

No public proof-of-concept exploit is currently available. See the Microsoft Security Response Center advisory for vendor-supplied technical detail.

Detection Methods for CVE-2025-54105

Indicators of Compromise

Unexpected child processes spawned by Brokering File System components running under elevated tokens.
Standard-user processes creating threads that repeatedly open, rename, or replace files in broker-mediated paths.
Sudden token elevation events on user sessions without a corresponding legitimate UAC prompt or service invocation.

Detection Strategies

Monitor Windows Security event IDs 4688 and 4672 for process creation followed by privilege assignment from non-administrative parents.
Correlate high-frequency file handle operations on the same path from a single low-privileged process, which is characteristic of race window brute-forcing.
Apply behavioral EDR rules that flag TOCTOU patterns such as rapid symlink or junction creation preceding privileged file operations.

Monitoring Recommendations

Enable object access auditing on sensitive system directories accessed by the Brokering File System.
Ingest Sysmon events 1, 11, and 13 into a SIEM to baseline normal broker activity and alert on deviation.
Track patch compliance for Windows 11 24H2 and Windows Server 2022/2025 hosts to identify unpatched systems most at risk.

How to Mitigate CVE-2025-54105

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-54105 to all affected Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025 hosts.
Restrict interactive and remote logon rights on servers to reduce the population of users who could stage a local exploit.
Audit local accounts and remove unnecessary standard-user access on high-value hosts such as domain controllers and jump servers.

Patch Information

Microsoft addressed CVE-2025-54105 in the September 2025 security update cycle. Administrators should deploy the update through Windows Update, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager. Consult the Microsoft CVE-2025-54105 Vulnerability Update for the specific KB article and build numbers applicable to each affected SKU.

Workarounds

No official workaround is published by Microsoft; patching is the required remediation path.
As a compensating control, enforce the principle of least privilege and use application control policies such as Windows Defender Application Control to block untrusted binaries from executing.
Enable attack surface reduction rules and credential guard to raise the cost of post-exploitation activity on unpatched hosts.

bash

# Verify installed Windows update level on affected hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Query current OS build to confirm patch applicability
Get-ComputerInfo | Select-Object OsName, OsVersion, OsBuildNumber, WindowsVersion