Windows ReFS CVE-2026-69617

Exploitation requires a local, low-privileged account (PR:L) on the affected Windows system - unauthenticated remote exploitation is not possible per the AV:L vector. The AC:H metric indicates that triggering the out-of-bounds read reliably requires satisfying elevated complexity, most likely a race condition or a crafted ReFS filesystem structure. Affected systems must be running Windows Server 2025 below build 10.0.26100.33438 or Windows 11 26H1 below 10.0.28000.2954. Systems that do not use ReFS volumes are not exposed to the filesystem parsing path. Exploitation is limited by: requirement for a local user session, high attack complexity (not a one-shot reliable exploit), and no reported public exploit chain as of analysis date.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H positions this as a meaningful local privilege escalation but with meaningful exploitation friction. AC:H indicates that exploitation is not straightforward - likely requiring a race condition, a crafted ReFS volume, or a specific sequence of filesystem operations to trigger reliably. PR:L requires the attacker to already hold a low-privileged local account, limiting exposure in well-managed environments. The full C:H/I:H/A:H impact triad reflects the ability to reach SYSTEM-level execution if exploitation succeeds. No EPSS data was provided, no CISA KEV listing, and no POC is referenced - all consistent with a moderate real-world priority. For organizations running Windows Server 2025 or Windows 11 26H1 with shared or multi-tenant local access (RDS environments, developer workstations, containerized workloads), this warrants prompt patching given the complete compromise potential if triggered. The AC:H mitigates urgency for isolated single-user systems.

A low-privileged local user on a Windows Server 2025 system - such as an RDS session user or a developer with a standard domain account - triggers a crafted sequence of ReFS filesystem operations or mounts a specially constructed ReFS volume, causing the kernel driver to perform an out-of-bounds read. The read leaks kernel memory or corrupts adjacent state under specific timing conditions (AC:H), which the attacker leverages to overwrite a security-sensitive kernel structure and execute code as SYSTEM. No public exploit code has been identified, so reliable exploitation likely requires non-trivial kernel exploitation expertise.