Microsoft Brokering File System Vulnerability Let Attackers Escalate Privileges

Microsoft patched a high-severity use-after-free vulnerability (CVE-2025-29970, CVSS 8.8) in the Brokering File System (bfs.sys) used by AppContainer/AppSilo sandboxes; the flaw arises from improper deallocation of a DirectoryBlockList head and can be abused by local attackers to escalate privileges. The report (discovered by HT3Labs) details exploitation requirements — impersonating AppSilo tokens, creating policy entries, and forcing rapid add-remove IOCTL cycles — notes medium-integrity processes can access the BFS device, and urges organizations to apply the January 2025 patch and monitor sandboxed environments.