Windows ReFS CVE-2026-50492

Exploitation requires the attacker to have physical access to the target system (CVSS AV:P), specifically sufficient access to connect or interact with a device that causes the Windows ReFS driver to process attacker-controlled file system structures - for example, inserting a USB drive or external disk formatted with a crafted ReFS image, or directly accessing local storage. No authentication is required (PR:N) once physical access is established. There is no user interaction requirement (UI:N), meaning the overflow can be triggered through OS-level automounting or driver activity without user consent beyond the physical act. Exploitation is NOT automatable and NOT remotely triggerable (SSVC: Automatable: no). Limiting factors: physical presence at the machine is mandatory; remote attackers cannot trigger this vulnerability; the attack is constrained to actors with direct, on-site access.

Despite a CVSS base score of 6.8 with high C/I/A impact, the physical attack vector (AV:P) is the most significant risk-limiting factor: exploitation requires the attacker to be physically present at the target system or to connect physical media to it, which eliminates remote and network-based threat actors. EPSS is very low at 0.42% (34th percentile), consistent with the physical-access constraint. SSVC corroborates: Exploitation is 'none', the attack is not automatable, and while Technical Impact is 'total', the non-automated physical requirement dramatically reduces realistic threat actor population. No KEV listing by CISA confirms no observed in-the-wild exploitation. The CVSS vector and SSVC data are internally consistent and reinforce one another. Real-world priority is LOW for most environments; the primary concern is high-security contexts where insider threats, physical supply chain attacks, or scenarios involving unattended or unlocked workstations (kiosks, shared terminals, server rooms without strict physical controls) are relevant threat models.

An attacker with physical access to a target Windows machine - such as an insider, a visitor with momentary unsupervised access, or a supply chain actor - connects a crafted storage device formatted with a malicious ReFS volume. When the Windows ReFS driver mounts or processes the volume's metadata, a heap-based buffer overflow is triggered, allowing the attacker to overwrite adjacent heap memory and redirect code execution. No public exploit code has been identified, but the physical-access requirement means exploitation would occur without any network or authentication barriers once the attacker is on-site.