Windows ReFS CVE-2025-62456
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege authenticated foothold
-
DeliveryDeliver crafted ReFS volume image over network
-
ExploitUser/system mounts malicious volume
-
ExecutionReFS driver parses structures, triggers heap overflow
-
PersistCorrupt heap and hijack control flow
-
ImpactExecute code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Resilient File System (ReFS) driver to process attacker-controlled volume data - i.e. a crafted ReFS volume/image (commonly a VHD/VHDX) must be mounted or parsed by an affected system. Per the CVSS vector, the attacker must be authenticated at low privilege (PR:L) but needs no user interaction (UI:N). Limiting factors: only Windows 11 (23H2/24H2/25H2) and Windows Server 2022/2022 23H2/2025 are affected, and realistic exploitation depends on ReFS being in use or the target being willing/configured to mount an attacker-supplied ReFS volume; systems using only NTFS volumes and blocking untrusted image mounts are far less exposed despite the AV:N rating. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, low-privilege heap overflow (CWE-122) yielding full confidentiality/integrity/availability compromise. However, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no known POC. The EPSS score of 1.10% (64th percentile) is modest and consistent with a Microsoft-internally-reported flaw (reporter secure@microsoft.com) that has no signs of active exploitation. The main tension is between the high CVSS and the 'over a network' language for a filesystem parser bug: Windows ReFS overflows of this class are typically triggered when a low-privileged user mounts/handles a maliciously crafted ReFS volume (e.g. a VHD image) rather than via a listening network service, so the PR:L/AV:N combination should be read as 'a local authenticated user processing attacker-supplied volume data,' not an anonymous remote service exploit. Net: a genuine patch-priority bug for ReFS-using Windows fleets, but the absence of KEV/POC and moderate EPSS place it below actively-exploited emergencies - verify the exact trigger path with the MSRC advisory before treating AV:N as a remote network-service vector. |
| Exploit ScenarioDerived | A low-privileged but authenticated user is induced to mount or open a maliciously crafted ReFS volume image (such as a VHD/VHDX delivered over the network), and the ReFS driver's parsing of the crafted on-disk structures overflows a heap buffer. The corruption is leveraged to execute attacker-controlled code in the kernel/driver context, achieving privilege escalation and full system compromise. No public exploit code is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Heap-based buffer overflow in the Windows Resilient File System (ReFS) driver enables an authenticated, low-privileged attacker to execute arbitrary code with full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-122). Exploitation requires the ReFS driver to process attacker-controlled volume data, which in practice means a crafted ReFS image (often delivered as a VHD/VHDX) must be mounted or parsed by the targeted system; no user interaction is needed beyond that mount, and the attacker needs only low privileges. Microsoft Windows 11 23H2, 24H2, and 25H2, plus Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 are affected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and EPSS is modest at 1.10% (64th percentile); the vendor advisory and fixes are published through the Microsoft Security Response Center update guide.
RemediationAI
Apply the Microsoft security update for CVE-2025-62456 as published in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62456); patch status is per vendor advisory and no independently confirmed fix version string was available in the supplied data, so administrators should obtain the exact KB/build from that advisory and deploy it through Windows Update, WSUS, or Microsoft Update Catalog, prioritizing Windows 11 23H2/24H2/25H2 and Windows Server 2022/2022 23H2/2025 hosts that mount ReFS volumes. Because exploitation hinges on the ReFS driver parsing untrusted volume data, the most effective compensating control is to stop untrusted images from reaching that parser: restrict or disable the mounting of VHD/VHDX and other disk images by non-administrative users (Group Policy 'Allow mounting of disk images' / disk-image mount restrictions), and enforce that only trusted, signed images are mounted. Where ReFS is not required, removing or not enabling the ReFS feature on Windows Server (ReFS is an optional feature there) eliminates the attack surface entirely, at the cost of losing ReFS-specific capabilities such as integrity streams, block cloning, and large-volume scalability; note that ReFS is not cleanly removable on Windows 11 clients, so image-mount restrictions are the practical client-side mitigation. Additionally, treat authenticated low-privilege access as a prerequisite: tighten remote access (restrict RDP/SMB to trusted networks, MFA, least privilege) so an attacker cannot establish the PR:L foothold the vector requires, and monitor for unexpected ReFS mount operations or image-file execution as a detection backstop. These controls reduce exposure but do not repair the underlying overflow, so patching remains the primary action.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ReFS (Resilient File System, the successor technology to NTFS) is implemented largely in kernel-mode drivers that parse on-disk volume metadata - superblocks, B+ tree nodes, object tables, and allocation structures - whenever a ReFS-formatted volume is mounted. This CVE is a classic CWE-122 heap-based buffer overflow, meaning a length or size field taken from parsed volume metadata is trusted without adequate bounds validation, so a crafted structure causes a write past the end of a heap-allocated kernel buffer. Because the vulnerable code path runs in kernel mode and the overflow is driven by file-system metadata rather than by network packets in the traditional sense, the CVSS AV:N rating reflects delivery of a malicious image/volume over a network share or remote channel, while the PR:L rating reflects the requirement that the attacker already hold a low-privileged foothold on, or authenticated access to, the target. The scope is unchanged (S:U), so the compromise is confined to the host running the ReFS driver. Affected CPEs cover the Windows 11 23H2/24H2/25H2 client releases and Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025, i.e. every supported platform where the ReFS driver is present and can be invoked by mounting a volume. Note that ReFS handling of untrusted, externally supplied images is the practical attack surface: systems that never mount ReFS volumes or third-party disk images do not expose this code path, which substantially narrows real-world exposure relative to the AV:N vector's apparent reach.
Know when Windows 11 23h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Concur with vendor: authenticated low-priv user (PR:L) processes network-delivered crafted ReFS data (AV:N) with no interaction, heap overflow yields full code execution and complete CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.
Executive ViewAI
A high-severity heap buffer overflow in the Microsoft Resilient File System (ReFS) driver leaves Windows 11 23H2, 24H2, and 25H2 along with Windows Server 2022, Server 2022 23H2, and Server 2025 exposed to full system compromise by an authenticated low-privileged user who simply mounts a crafted ReFS volume image. No vendor-released patch was identified at time of analysis, so any team that routinely attaches VHD/VHDX files, restores backups, or processes externally supplied storage images carries unmitigated risk to data confidentiality, integrity, and availability. Leadership should treat this as a priority because the affected servers and endpoints typically host sensitive workloads, and the only interim defense is restricting who and what can mount ReFS volumes.
No vendor-released patch identified at time of analysis; interim mitigations are to disable or avoid the ReFS driver on systems where it is not required, prevent ordinary users and services from mounting untrusted ReFS volumes or VHD/VHDX images, restrict volume-mount rights to least-privileged designated administrators, route all externally supplied storage images through an isolated and scanned handling process, and monitor the Microsoft Security Response Center update guide for an official fix to deploy as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)CVE.org
More in Windows 11 23h2
View allInternet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
GitHub PoC
Exploit-DB