Windows ReFS CVE-2025-59206

Exploitation requires local access to a host where the ReFS Deduplication Service is present and active - i.e., a volume formatted with ReFS and data deduplication enabled, which is a deliberately configured, non-default feature primarily found on Windows Server 2025 and specific Windows 11 24H2/25H2 deployments using ReFS. The attacker must already be able to run code on the machine (AV:L) and must win a race condition to reliably trigger the use-after-free (AC:H), which significantly limits reliable exploitation. User interaction is not required (UI:N). The chief limiting factors are: physical/local presence or an existing session on the host, the dependency on ReFS with deduplication being in use rather than default NTFS, and the high-complexity timing/race requirement.

This is a locally-exploitable elevation-of-privilege flaw (CWE-416 use-after-free) in the Windows ReFS Deduplication Service, rated CVSS 7.4. The signals converge on a moderate, not urgent, priority. The CVSS vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) shows local attack vector with HIGH attack complexity - meaning successful exploitation depends on winning a race or satisfying conditions outside the attacker's control, which materially lowers reliability. EPSS is low at 0.38% (30th percentile), consistent with no public exploit and no active-exploitation signal. The vulnerability is NOT on the CISA KEV list and no POC is referenced, so there is no evidence of in-the-wild use. One notable tension: Microsoft assigns PR:N (no privileges required), yet the vulnerability class is 'Elevation of Privilege,' which by definition presumes the attacker already holds some foothold to elevate from - verify the privilege precondition with Microsoft, as PR:N on a local EoP is unusual and may understate the real prerequisite. There is also a labeling tension between the 'Information Disclosure' tag and the full C:H/I:H/A:H impact of a memory-corruption EoP. Net: a legitimate patch-in-normal-cycle issue for affected Windows builds, not a drop-everything emergency, given local vector, high complexity, low EPSS, and no exploitation evidence.

A low-privileged attacker already executing code on a Windows 11 24H2/25H2 or Windows Server 2025 host triggers a use-after-free in the ReFS Deduplication Service, likely by manipulating files or dedup operations to free and then reuse a memory object. By winning the required race condition (reflected in AC:H), they reuse the dangling pointer to corrupt memory and execute code in the service's higher-privileged context, elevating from standard user toward SYSTEM. No public exploit code is identified at time of analysis, so exploitation would require independent development.