Windows ReFS CVE-2026-70116

Exploitation requires direct physical access to the target device (AV:P) - the attacker must be able to present attacker-controlled ReFS-formatted storage to the Windows Resilient File System driver, such as by attaching or mounting a malicious volume. Exploitation is further limited by high attack complexity (AC:H), meaning the overflow is not reliably triggerable and depends on specific conditions the attacker cannot fully control. The affected component is ReFS specifically, which is not the default filesystem on Windows client systems, narrowing the realistic attack surface to systems where ReFS volumes are mounted. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the physical-access prerequisite makes remote or scaled exploitation infeasible.

This is a low-priority, high-barrier vulnerability despite being a stack-based buffer overflow (CWE-121). The CVSS 3.1 vector (AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, base 4.2) is internally consistent and signals the practical difficulty: AV:P requires the attacker to have physical access to the device, and AC:H means success depends on conditions outside the attacker's control (e.g., winning a race or specific memory/disk state). All exploitation signals agree on low risk: there is no KEV listing (confirmed actively exploited = no), no public POC identified, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial'. No EPSS score was provided in the input. The only notable impact is to integrity (I:H) via a security-feature bypass - confidentiality and availability are untouched (C:N/A:N), consistent with SSVC 'partial' technical impact. There is no conflict between the signals: a physical-access, high-complexity, integrity-only bug with no exploitation evidence is a genuinely low operational priority, suitable for routine patching cycles rather than emergency response.

An attacker with hands-on physical possession of a target machine (e.g., a lost, stolen, or seized device) attaches or mounts a specially crafted ReFS-formatted volume, triggering a stack-based buffer overflow in the ReFS parsing code to bypass a Windows security feature and tamper with integrity-protected state. The high attack complexity (AC:H) means the attacker must satisfy specific conditions to reliably trigger the overflow. No public exploit code has been identified at time of analysis.