Windows ReFS CVE-2025-59210

Requires the target to be running ReFS (Resilient File System) with the Data Deduplication feature/service active - ReFS is not the default Windows filesystem and deduplication is an opt-in role/feature, so default installations are not exposed. The attacker needs local access to the host and must win the race/timing window implied by AC:H to reliably trigger the use-after-free; there is no remote vector (AV:L) and no user interaction (UI:N). Limiting factors sharply narrowing real-world exposure: local-only access, non-default ReFS+dedup configuration, and high exploitation complexity.

This is a genuine but second-tier priority rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N) describes a local-only attack with HIGH complexity, meaning exploitation hinges on winning a race condition or meeting specific timing conditions inherent to the CWE-416 use-after-free. Impact is severe where it lands (C:H/I:H/A:H, unchanged scope), consistent with a low-privileged local user elevating to SYSTEM via the ReFS Deduplication Service. The exploitation signals, however, are all low-to-moderate: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit was provided - so this is 'no public exploit identified at time of analysis.' One point of tension to verify: Microsoft assigned PR:N (no privileges), yet an elevation-of-privilege UAF in a local service realistically presupposes an existing low-privileged foothold to interact with the service - treat the PR:N as optimistic and assume a local authenticated attacker in practice. Net: a credible post-compromise privilege-escalation primitive worth patching on the normal cycle, not a mass-exploitation threat, given local-only vector, high attack complexity, low EPSS, and absence of KEV/POC.

A local attacker who has already gained low-privileged code execution on a Windows 11 24H2/25H2 or Server 2025 host with a ReFS volume using data deduplication triggers a use-after-free in the ReFS Deduplication Service. By winning the required race condition, they corrupt memory in the higher-privileged service to execute code as SYSTEM. No public proof-of-concept exploit is available at time of analysis.