Windows ReFS CVE-2026-102227

Exploitation requires the attacker to already hold a low-privileged authenticated local account on the Windows host (PR:L, AV:L) and requires the ReFS (Resilient File System) code path to be reachable - i.e., a ReFS-formatted volume being mounted/parsed by the target. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The principal limiting factors are: (1) no remote reachability - the attacker needs prior local access; (2) dependence on ReFS being in use, which is common on Windows Server storage, Storage Spaces, and Hyper-V/backup deployments but not on default NTFS-only endpoints; (3) authentication is required per the CVSS PR:L metric.

This is a credible local privilege-escalation / code-execution issue but not a drop-everything emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent: a local, low-privileged, authenticated attacker can achieve full confidentiality, integrity, and availability impact on the affected system with low complexity and no user interaction. The key risk-limiting factor is the local attack vector (AV:L) combined with required privileges (PR:L) - an attacker must already have authenticated code-execution footing on the host, so this is a post-compromise escalation primitive, not a remotely-reachable entry point. No EPSS score, no CISA KEV listing, and no POC indicator are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There are no conflicting signals: the description ('execute code locally', 'authorized attacker') aligns well with the local/low-privilege CVSS vector. Realistic prioritization: treat as a standard Patch-Tuesday-class local EoP - important to remediate on multi-user, shared, or server hosts where untrusted users have local access, lower urgency on single-user endpoints. SSVC framing cannot be computed from the input (no exploitation/automatable/technical-impact fields supplied); technical impact would be 'total' given C:H/I:H/A:H, but exploitation status is 'none' on available data.

An attacker who already has a low-privileged authenticated session on a Windows host crafts malicious data on a ReFS-formatted volume (or triggers a vulnerable ReFS parsing path) to overflow a heap buffer in the ReFS driver, corrupting kernel/heap memory to execute attacker-controlled code at higher privilege. Because the CVSS complexity is low (AC:L) and no user interaction is required, reliable local exploitation is plausible, though it is bounded by the need for prior local access. No public proof-of-concept is identified in the provided data.