EUVD-2026-44285
GHSA-ff4v-gf5j-qqqr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local filesystem-parsing bug triggered by mounting an attacker-supplied volume, so AV:L and UI:R with PR:N; kernel-context overflow yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows' Resilient File System (ReFS) driver lets an attacker run arbitrary code by inducing a victim to mount or open a maliciously crafted ReFS volume. The flaw is a heap-based buffer overflow (CWE-122) in ReFS metadata parsing affecting Windows 10, Windows 11 (through 26H1), and Windows Server 2016-2025. CVSS is 7.8 (AV:L/UI:R); there is no public exploit identified at time of analysis and it is not in CISA KEV, so exploitation would require crafting a malicious volume and social-engineering the user to attach it.
Technical ContextAI
ReFS (Resilient File System) is Microsoft's newer filesystem, designed for large-scale storage, resiliency, and Storage Spaces, and shipped as a kernel-mode driver alongside NTFS on modern Windows client and server SKUs. The CPE data confirms the driver is present across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016 through 2025 including Server Core installations. The root cause class is CWE-122, a heap-based buffer overflow: the ReFS parser copies attacker-controlled data from on-disk filesystem structures into an undersized heap allocation, corrupting adjacent heap memory. Because filesystem drivers run in kernel context and parse untrusted structures whenever a volume is mounted, a malformed ReFS volume (e.g. a VHD/VHDX or removable disk) becomes the delivery mechanism for the overflow.
RemediationAI
Apply the Microsoft security update for CVE-2026-58530 to all affected Windows client and server builds; a patch is available per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58530 (consult that page for the exact per-build KB numbers, as an exact fixed version string was not provided in the input). As a compensating control until patched, restrict the ability to mount untrusted volumes: block automatic mounting of removable and virtual disks, disallow attaching untrusted VHD/VHDX files, and use Group Policy or removable-storage access controls to prevent users from connecting unknown external media (trade-off: this can disrupt legitimate use of removable disks and mounted virtual drives). Since NTFS remains the default filesystem, environments that do not rely on ReFS incur little functional loss from tightly restricting who can mount ReFS-formatted volumes.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today