Microsoft has published details for CVE-2026-25167, a use‑after‑free elevation‑of‑privilege flaw in the Microsoft Brokering File System (BFS) that can allow a locally‑accessible attacker to escalate to SYSTEM‑level privileges on unpatched machines; Microsoft lists the vulnerability in the March...