Windows ReFS CVE-2026-83952

Exploitation requires a locally authenticated user session with at minimum low-privilege rights (PR:L) on a system running an affected Windows 11 or Windows Server 2025 build with the ReFS driver active. The attack vector is strictly local (AV:L); remote unauthenticated exploitation is not possible. No interaction from a secondary user is required (UI:N). The key limiting condition is local code-execution access - an unauthenticated remote attacker cannot reach the vulnerable ReFS driver code path directly. Exploitation is most relevant in multi-user environments, terminal server deployments, cloud VMs with shared-access models, or scenarios following initial compromise via phishing or RCE on a lower-privileged account.

The CVSS 7.8 score reflects a low-complexity, no-user-interaction local privilege escalation - a metric profile historically associated with reliable, widely-weaponized Windows LPE primitives. The AC:L rating indicates exploitation does not require race conditions or precise heap grooming beyond standard kernel heap manipulation techniques, meaning an attacker holding any local user session faces a low bar to SYSTEM. While no CISA KEV listing and no public proof-of-concept code have been identified, Windows kernel file-system driver LPEs are consistently converted into working exploits within weeks of disclosure and are routinely incorporated into post-exploitation tooling. The absence of an EPSS score in the provided data prevents empirical exploitation-probability quantification; risk is therefore assessed from vulnerability class, prevalence, and historical precedent. The primary scope-limiting factor is the local attack vector, meaning this is a second-stage escalation risk rather than a perimeter-crossing threat - defenders should prioritize patching systems where interactive or remote-shell access by untrusted principals is possible.

An attacker who has gained a low-privileged local user session - for example via credential theft, phishing-delivered malware, or an earlier remote code execution vulnerability - interacts with the ReFS driver by mounting or performing file-system operations on a ReFS-formatted volume. The malformed operation triggers the heap buffer overflow in the kernel driver, allowing the attacker to overwrite kernel heap structures and redirect execution to attacker-controlled code, achieving SYSTEM-level privileges. No public proof-of-concept code is currently known, but the low-complexity CVSS profile suggests a straightforward exploitation path once the precise vulnerable code path is reverse-engineered from the patch diff.