EUVD-2026-43807
GHSA-54cf-prcc-99vc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel-driver code execution requires an existing low-privileged foothold (AV:L, PR:L), triggers without user interaction at low complexity, and yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft's Resilient File System (ReFS) driver allows an authorized (low-privileged) attacker to run arbitrary code with elevated context via a numeric truncation flaw. The bug affects the ReFS component shipped with Windows 10, Windows 11, and Windows Server 2016 through 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the CVE's own tags label it 'Information Disclosure' while the description and CVSS impact (C:H/I:H/A:H) describe full code execution - the code-execution reading should be treated as authoritative.
Technical ContextAI
ReFS (Resilient File System) is Microsoft's newer-generation filesystem used for Storage Spaces, Dev Drive, and large-volume/data-integrity scenarios on Windows client and server. The root cause is CWE-197 (Numeric Truncation Error): a value is converted into a smaller integer type, discarding high-order bits and yielding a smaller-than-expected result. In a kernel-mode filesystem parser this typically leads to under-allocated buffers or miscalculated lengths/offsets when handling on-disk metadata structures, enabling memory corruption. Because ReFS parsing runs in kernel context, successful exploitation can escalate to arbitrary code execution. The CPE set confirms the affected surface is the OS-bundled ReFS driver across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016/2019 (including Server Core), with tags also naming Server 2022 and Server 2025.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for your specific Windows/Windows Server SKU as published in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49792); exact fixed build numbers are listed there per product and are not reproduced in the input data. Because exploitation involves the ReFS driver, effective compensating controls on unpatched systems include avoiding mounting untrusted or attacker-supplied ReFS volumes/VHDs and restricting the ability of low-privileged users to attach removable or virtual disks (trade-off: may disrupt legitimate removable-media and Dev Drive workflows); on hosts that do not require ReFS, using NTFS instead removes the affected code path from active use (trade-off: loses ReFS-specific integrity and Storage Spaces features). Standard least-privilege hardening reduces the low-privilege foothold the attacker needs, but patching is the only complete fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-197 – Numeric Truncation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today