Windows ReFS CVE-2026-49793

Exploitation requires the target host to have an ReFS-formatted volume present and reachable by the attacker, plus an existing low-privileged local account or code-execution foothold on that host (CVSS PR:L) - this is not remotely exploitable (AV:L) and requires no user interaction (UI:N). The concrete prerequisite is the ability to feed attacker-influenced data into ReFS's heap-allocating parse path (e.g., operations on files/metadata on an ReFS volume, or mounting a crafted ReFS image). Limiting factors: attackers without any local access cannot reach the flaw, hosts that use only NTFS are not exposed, and successful heap-overflow exploitation is subject to Windows kernel heap mitigations that may reduce reliability. The specific ReFS feature or file-operation that triggers the overflow is not detailed in the description and should be confirmed against the MSRC advisory.

The CVSS 3.1 base score of 7.8 (High) reflects easy local exploitation: AV:L (local vector), AC:L (low complexity), PR:L (some existing privilege required), UI:N (no user interaction), and full H/H/H impact. This is a classic local privilege-escalation profile - high impact but gated behind already having a foothold, which is why it sits below the critical remote-RCE tier. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active exploitation or automated weaponization; the realistic near-term risk is that this becomes a second-stage tool in an attack chain (post-initial-access privilege escalation) rather than an internet-facing mass-exploitation target. Microsoft is the reporting source and a patch is available, but no SSVC decision, EPSS probability, or exploit maturity data was supplied - those signals are UNKNOWN and should not be assumed benign. Note the CPE strings are encoded as 'cpe:2.3:a:' (application) despite ReFS being an operating-system component; this is a data-quality quirk to verify against the vendor advisory, not a substantive contradiction.

An attacker who has already gained low-privileged access to a Windows or Windows Server host with an ReFS volume (for example, a standard user account or a compromised low-privilege service) crafts input or file-system operations that drive the vulnerable ReFS code path into a heap overflow. By controlling the overflowing data, they corrupt adjacent heap structures to hijack execution and elevate to SYSTEM-level code execution. No public proof-of-concept was identified, and the low attack complexity means a working exploit, if developed, would be reliable.