EUVD-2026-44109
GHSA-572g-ggww-38vc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local parsing of a crafted ReFS image requires victim interaction (AV:L, UI:R) but no attacker privileges (PR:N); driver-context code execution yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft's Resilient File System (ReFS) driver affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a stack-based buffer overflow (CWE-121) can be triggered when a victim interacts with attacker-crafted ReFS data. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows an unauthenticated but user-interaction-dependent local attack yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so it currently represents a patch-priority rather than an active-exploitation emergency.
Technical ContextAI
ReFS (Resilient File System) is Microsoft's modern filesystem introduced as an alternative to NTFS, used for resiliency-focused storage such as Storage Spaces, Hyper-V VHD/VHDX volumes, and large data volumes on Windows Server. Parsing of ReFS on-disk structures happens in kernel/driver context, and CWE-121 (stack-based buffer overflow) indicates a fixed-size stack buffer is overrun when the driver processes attacker-controlled length or metadata fields, corrupting the stack and enabling control-flow hijack. Per the supplied CPE data the flaw is confirmed in windows_11_version_24h2, 25h2 and 26h1, plus windows_server_2025 including the Server Core installation, meaning the vulnerable ReFS code ships across current client and server builds.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50501 for your specific Windows 11 (24H2/25H2/26H1) or Windows Server 2025 build via Windows Update or WSUS as the primary fix; the exact patched build/KB number was not included in the provided data and should be confirmed on the MSRC page before deployment. As a compensating control until patched, avoid mounting or opening untrusted ReFS-formatted volumes, VHD/VHDX images, or removable media, since exploitation depends on interacting with attacker-supplied ReFS data - the trade-off is minimal in most environments because ReFS is typically used for controlled internal storage. Where feasible, restrict who can attach virtual disks or removable storage and use application allowlisting to reduce the chance a user is lured into opening a malicious image.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today