Windows ReFS CVE-2026-58530

Exploitation requires the victim to mount or open an attacker-crafted ReFS-formatted volume (such as a malicious VHD/VHDX image or removable disk) so the vulnerable ReFS driver parses its metadata - this is the concrete UI:R condition. No pre-existing authentication or privileges on the target are needed (PR:N), but the attack is strictly local (AV:L): the attacker cannot trigger it remotely and must both deliver the malicious volume and rely on the user to actively mount it. Limiting factors are the mandatory user interaction, the need to socially engineer or physically deliver the volume, and that ReFS mounting must be permitted in the environment.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High) describes a local attack requiring no prior privileges (PR:N) but mandatory user interaction (UI:R) - consistent with a filesystem-parsing bug that fires when a user mounts an attacker-supplied volume rather than over the network. High impact across confidentiality, integrity, and availability reflects potential kernel-level code execution. No EPSS score, KEV entry, SSVC decision, or POC was supplied: it is not confirmed actively exploited and no public exploit is identified at time of analysis, so this is a patch-on-cycle priority rather than an emergency, tempered by the UI:R requirement that meaningfully limits mass exploitation. One nuance worth verifying with Microsoft: PR:N combined with UI:R means the 'unauthorized attacker' supplies the malicious volume, but the victim must actively mount it - the practical barrier is higher than a raw PR:N reading suggests.

An attacker crafts a malicious ReFS-formatted volume (for example a VHDX image or a USB drive) whose on-disk metadata triggers the heap overflow, then delivers it to a victim via email, download, or physical media. When the user double-clicks or otherwise mounts the volume, the ReFS driver parses the malformed structures and executes attacker-controlled code with elevated (kernel) privileges. No public exploit is identified at time of analysis, and the AV:L/UI:R vector means the attack hinges on convincing the victim to attach the volume.