Windows ReFS CVE-2026-50441

Exploitation requires local access with an existing authenticated account on the target (CVSS PR:L, AV:L), and the host must have ReFS in use for the vulnerable driver code path to be reachable - a condition more commonly met on Windows Server storage/backup roles than on default client installs. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker has any local foothold on an affected, unpatched, ReFS-using system, no additional special configuration is required. Limiting factors: the flaw is not remotely exploitable, cannot be triggered without prior local authentication, and its practical relevance is bounded by whether ReFS volumes are actually present.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H, base 7.8) describes a locally exploitable flaw of low complexity requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact - a classic local EoP profile. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; treat it as no public exploit identified at time of analysis. This is a real but not emergency-tier issue: it requires an attacker to already have a foothold (local, authenticated) and is not remotely reachable, so it is most relevant as a post-compromise escalation step. Note a data conflict: the NVD-style description states privilege elevation, while the vendor Tags label this 'Information Disclosure' - verify the precise impact against the Microsoft advisory, though the CVSS C/I/A:H triad supports the full EoP reading.

An attacker who already has a low-privileged account or code execution on a Windows/Windows Server host with ReFS in use crafts filesystem metadata or a system call that feeds an untrusted pointer into the ReFS kernel driver. The resulting controlled dereference corrupts kernel memory and is leveraged to execute code as SYSTEM, escalating from a limited user to full machine control. No public exploit is identified at time of analysis, but the low attack complexity makes reliable weaponization plausible once details circulate.