CVE-2026-50458Disclosure(microsoft / windows_11_24h2)

LOWCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch microsoft windows_11_24h2 systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

2.5/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50458

Weakness type (CWE)

CWE-362CWE-416

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2025

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
10 mentions across 6 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 4 signals
Technical details provided in 8 signals
Disclosure: 5 classified signals
General: 2 classified signals
Peaked 3d ago at 4 mentions (2026-07-23); latest day: 1
10 total mentions across 6 days

Affected systems

Vendors

microsoft

Products

windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2025

Deep dive

Activity timeline10 mentions / 6d

Signal classification3 categories

Disclosure

550.0%

Patch

330.0%

General

220.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	Patch1
2026-07-22	2	Disclosure1Patch1
2026-07-23	4	Disclosure3Patch1
2026-07-24	1	General1
2026-08-24	1	General1
2026-09-13	1	Disclosure1

Full discourse10 posts

Rotce@Rotcee_83d
Patch
Hi everyone! CVE-2026-50458, a Windows kernel 0-day I discovered a few months ago has been patched by Microsoft in this month's Patch Tuesday. You can read the in-depth analysis here: https://rotcee.github.io/posts/CVE-2026-50458-finding-a-UAF-in-windows-brokering-file-system/
Post summary
The post announces that CVE-2026-50458, a Windows kernel zero-day, was patched by Microsoft during Patch Tuesday, and provides a link to an in-depth analysis.
3500205939.0K
122 followersView on X
/r/netsec@_r_netsec83d
Disclosure
CVE-2026-50458: Finding a UAF in the Windows Brokering File System https://rotcee.github.io/posts/CVE-2026-50458-finding-a-UAF-in-windows-brokering-file-system/
Post summary
The post announces CVE-2026-50458, detailing a use‑after‑free in the Windows Brokering File System, but provides no PoC, exploit code, or patch information.
018061333.6K
33.7K followersView on X
/r/netsec@_r_netsec31d
Disclosure
CVE-2026-50458: Finding a UAF in the Windows Brokering File System https://rotcee.github.io/posts/CVE-2026-50458-finding-a-UAF-in-windows-brokering-file-system/
Post summary
A blog post announces the discovery of a use‑after‑free vulnerability in the Windows Brokering File System, providing technical details and a link to further information, but no exploit code, active attack reports, or patch guidance is included here.
08047222.8K
34.2K followersView on X
Nicolas Krassas@Dinosn83d
Disclosure
CVE-2026-50458: Finding a UAF in the Windows Brokering File System https://rotcee.github.io/posts/CVE-2026-50458-finding-a-UAF-in-windows-brokering-file-system/
Post summary
The post announces the discovery of CVE‑2026‑50458, a Use‑After‑Free vulnerability in the Windows Brokering File System, and links to a detailed blog entry.
0402874.9K
160.9K followersView on X
Jamaica Cyber Incident Response Team (JaCIRT)@cirtgovjm81d
General
URGENT ADVISORY🚨: Windows 11 and Windows Server 2025 are exposed to a high-severity vulnerability in Microsoft's Brokering File System (BFS), identified as CVE-2026-50458. CLICK HERE FOR MORE INFORMATION👇 https://cirt.gov.jm/advisory/high-severity-windows-brokering-file-system-vulnerability-cve-2026-50458-enables-local #JaCIRT #CIRT #Cybersecurity #Windows https://t.co/0KX9c7dNjX
Post summary
The tweet announces CVE‑2026‑50458 as a high‑severity issue but offers no PoC, exploit tools, patch, or detailed technical data, merely directing readers to a CIRT advisory for more information.
01000158
1.2K followersView on X
IntegSec@integ_sec50d
General
CVE-2026-50458: Microsoft Brokering File System Use-After-Free Privilege Escalation - What It Means for Your Business and How to Respond https://hubs.li/Q04t-rJ20
Post summary
The article appears to discuss the Microsoft use‑after‑free privilege escalation (CVE‑2026‑50458) and offers guidance for business response, but does not provide explicit PoC, exploit, or patch details.
0000026
33 followersView on X
TECHEPAGES@techepages82d
Disclosure
⚠️ A high-severity vulnerability (CVE-2026-50458, CVSS 7.8) in Windows' Brokering File System driver (bfs.sys) lets a local attacker escalate privileges to SYSTEM via a use-after-free race condition, affecting Windows 11 (24H2/25H2/26H1) and Windows Server 2025 — no active exploitation reported yet, but patch now. 🔵 Attackers with local access can send crafted IOCTL requests to corrupt kernel memory and break out of sandboxed environments (AppContainer/UWP) 🔵 Fixed in the July 14, 2026 Patch Tuesday update (KB5101650 / July 2026 CU) — check your build number against the vulnerable ranges
Post summary
A high‑severity local privilege escalation vulnerability (CVE‑2026‑50458) affecting Windows 11 and Server 2025 has been disclosed, and the issue is fixed by the July 14, 2026 Patch Tuesday update (KB5101650).
0000087
32 followersView on X
The Daily Tech Feed@dailytechonx83d
Patch
Microsoft has patched CVE-2026-50458, a critical vulnerability in the Brokering File System (BFS) driver affecting Windows 11 and Server 2025. This flaw allows local attackers to escalate privileges, posing significant security risks. Immediate updates are essential to safeguard systems. #WindowsSecurity #CVE202650458 #BFS #PrivilegeEscalation #MicrosoftPatch #CyberSecurity #SystemUpdate https://thedailytechfeed.com/critical-windows-bfs-vulnerability-threatens-system-security/
Post summary
Microsoft released a patch for CVE‑2026‑50458, a critical local privilege escalation flaw in the Windows 11 and Server 2025 BFS driver; users should apply the update immediately.
0000072
553 followersView on X
✪ 𝕱𝖆𝖍𝖆𝖉@fad_77783d
Disclosure
ثغرة Use After Free جديدة تستحق الانتباه. CVE-2026-50458 تكشف خللا في Windows Brokering File System، وتبرز أهمية تحليل مكونات النظام الأقل وضوحا عند تقييم سطح الهجوم. New UAF research in Windows deserves attention. CVE-2026-50458 highlights a Use After Free in the Windows Brokering File System, a reminder that lesser known system components can still carry meaningful attack surface. https://rotcee.github.io/posts/CVE-2026-50458-finding-a-UAF-in-windows-brokering-file-system/ #WindowsSecurity #VulnerabilityResearch #UseAfterFree
Post summary
CVE-2026-50458 introduces a new Use After Free vulnerability in the Windows Brokering File System; research is shared via a blog post, but no patches, exploits, or active exploitation evidence are provided.
0000032
79 followersView on X
Windows Forum@windowsforum91d
Patch
🪟 CVE-2026-50458 turns “limited access” into “your PC is mine.” Install KB5101650—because Windows privilege boundaries apparently needed a security update to remember their job. https://windowsforum.com/threads/cve-2026-50458-install-kb5101650-to-fix-windows-11-privilege-escalation.438545/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #PrivilegeEscalation #PatchTuesday #Windows11Security #Cve202650458 https://t.co/MfJtTZKCI0
Post summary
The post highlights a Microsoft patch (KB5101650) that addresses the privilege‑escalation flaw in Windows 11 identified by CVE-2026-50458, urging users to install it.
00000138
1.2K followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2025	-	-	-

Explore more

Back to dashboard microsoft CVEs windows_11_24h2 vulnerabilities

What researchers are saying

CVE-2026-50458

Nicolas Krassas[verified]@DinosnDisclosure

The post announces the discovery of CVE‑2026‑50458, a Use‑After‑Free vulnerability in the Windows Brokering File System, and links to a detailed blog entry.

IntegSec[verified]@integ_secGeneral

The article appears to discuss the Microsoft use‑after‑free privilege escalation (CVE‑2026‑50458) and offers guidance for business response, but does not provide explicit PoC, exploit, or patch details.

TECHEPAGES[verified]@techepagesDisclosure

A high‑severity local privilege escalation vulnerability (CVE‑2026‑50458) affecting Windows 11 and Server 2025 has been disclosed, and the issue is fixed by the July 14, 2026 Patch Tuesday update (KB5101650).

The Daily Tech Feed[verified]@dailytechonxPatch

Microsoft released a patch for CVE‑2026‑50458, a critical local privilege escalation flaw in the Windows 11 and Server 2025 BFS driver; users should apply the update immediately.

✪ 𝕱𝖆𝖍𝖆𝖉[verified]@fad_777Disclosure

CVE-2026-50458 introduces a new Use After Free vulnerability in the Windows Brokering File System; research is shared via a blog post, but no patches, exploits, or active exploitation evidence are provided.

Windows Forum[verified]@windowsforumPatch

The post highlights a Microsoft patch (KB5101650) that addresses the privilege‑escalation flaw in Windows 11 identified by CVE-2026-50458, urging users to install it.

Rotce@Rotcee_Patch

The post announces that CVE-2026-50458, a Windows kernel zero-day, was patched by Microsoft during Patch Tuesday, and provides a link to an in-depth analysis.

/r/netsec@_r_netsecDisclosure

The post announces CVE-2026-50458, detailing a use‑after‑free in the Windows Brokering File System, but provides no PoC, exploit code, or patch information.