Windows ReFS CVE-2026-50407

Exploitation requires the attacker to already possess authenticated low-privileged local code execution on the target (CVSS PR:L, AV:L), and the host must have the Resilient File System (ReFS) component reachable - realistically a mounted or mountable ReFS volume, or the ability to supply/attach ReFS-formatted media that the vulnerable driver parses. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker cannot exploit this remotely or without a prior foothold, and hosts that never provision or mount ReFS volumes present a much smaller effective attack surface than the broad CPE list implies; the specific ReFS operation or metadata structure that triggers the overflow is not detailed in the available data and should be confirmed via the MSRC advisory.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) describes a locally exploitable, low-complexity elevation-of-privilege bug requiring only low existing privileges and no user interaction, with full CIA impact on the host - a classic and highly valuable local EoP primitive for post-compromise chaining. No EPSS score, KEV entry, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; the absence of a KEV listing means there is no confirmed active exploitation, and no POC was referenced, so this is not currently a mass-exploitation emergency. However, kernel EoP flaws in ubiquitous Windows components are routinely weaponized after the fact, so the practical priority is high for any environment where attackers can obtain low-privileged local execution. Note that ReFS is not mounted on every Windows host by default, which meaningfully narrows the real attack surface compared to a core-OS flaw - verify ReFS usage before ranking this above other patch-Tuesday EoPs.

An attacker who already has a low-privileged foothold on a Windows host - for example through phishing, a compromised service account, or a low-integrity process - invokes a crafted ReFS file-system operation (or mounts a maliciously formatted ReFS volume) that overflows a kernel heap buffer, corrupts adjacent kernel objects, and escalates to SYSTEM. Because the vector is local with low complexity and no user interaction, this is a reliable post-exploitation privilege-escalation step rather than an initial-access vector; no public exploit was identified at time of analysis.