Windows ReFS CVE-2026-54109

Exploitation requires the attacker to already possess authenticated local access at a low privilege level (CVSS PR:L, AV:L) and to be able to reach the ReFS filesystem driver - i.e. the target host must have an ReFS volume the attacker can operate against, or accept an attacker-supplied/mounted ReFS structure. No user interaction is required (UI:N) and attack complexity is low (AC:L). The limiting factors are the need for a pre-existing local account and the presence/reachability of ReFS: systems that do not use ReFS or that prevent standard users from accessing ReFS volumes materially reduce exposure. This is not remotely exploitable and not usable for initial access.

This is a solid, actionable local escalation issue but not a top-of-queue emergency. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U with C:H/I:H/A:H gives 7.8 (High): the attacker must already have local, low-privileged access, but once there, exploitation is low-complexity, requires no user interaction, and yields full confidentiality, integrity and availability impact - consistent with kernel code execution. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from this input; the absence of a KEV entry means there is no confirmation of active exploitation, and no public exploit was identified at time of analysis. The realistic risk profile is a post-compromise privilege-escalation primitive - valuable to an attacker who already has a foothold (malware, phishing, or a compromised standard user) rather than an initial-access or wormable threat. Priority should be elevated on multi-user and server systems where standard users can reach ReFS volumes.

An attacker who has already gained low-privileged access to a Windows host - via phishing, a compromised standard-user account, or malware - crafts or mounts a malicious ReFS structure, or triggers a specially formed operation against an ReFS volume, causing the integer overflow in the kernel driver and executing code with SYSTEM-level privileges. This turns an initial foothold into full host compromise. No public exploit was identified at time of analysis, and no user interaction beyond the attacker's own local session is needed.