Windows ReFS CVE-2026-50318

Exploitation requires local access to the target and a low-privileged authenticated account on the host (CVSS PR:L), with no user interaction needed (UI:N) and low attack complexity (AC:L). A concrete environmental prerequisite is the presence of an ReFS-formatted volume the attacker can interact with, since the vulnerable code path is in the Resilient File System driver; hosts using only NTFS are far less exposed in practice. Limiting factors: the attack cannot be launched remotely (AV:L) and the attacker must first obtain an authenticated local foothold, so this functions as a post-access escalation step rather than an initial-access vector.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes a local, low-complexity attack requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability - a classic local privilege-escalation profile. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis.' The primary real-world constraint is the local attack vector: an attacker must already have code execution or an authenticated foothold on the host, and the target volume must use ReFS. This makes it a strong second-stage escalation primitive (valuable in post-compromise, malware, and pentest chains) rather than an internet-facing, wormable threat. Priority should be high for systems using ReFS volumes but is bounded by the need for prior local access. No conflicting signals were observed in the provided data; the main missing datum is EPSS.

An attacker who has already gained a low-privileged authenticated foothold on a Windows host (for example, via phishing, a compromised service account, or a standard user session) crafts input that drives malformed data into the ReFS driver's vulnerable stack buffer. The resulting stack-based overflow corrupts kernel memory and lets the attacker execute code as SYSTEM, completing a local privilege escalation. No public proof-of-concept is identified at this time, and the low attack complexity means a working exploit, if developed, would be reliable.