Windows ReFS CVE-2026-83999

Exploitation requires a local authenticated account with at least low user privileges (PR:L) on a Windows system where the ReFS Deduplication Service is active - this service is primarily relevant to Windows Server 2025 with deduplication configured on ReFS volumes, and is less commonly present on standard Windows 11 client installations unless explicitly enabled. The attack also requires winning a race condition between the service's path resolution and file access steps (AC:H), meaning reliable exploitation demands timing control (e.g., via file system operation throttling or thread scheduling manipulation). Remote unauthenticated exploitation is not possible. Exploitation is limited to Windows 11 24H2/25H2/26H1 and Windows Server 2025 - prior Windows versions and NTFS-only environments are not affected by this specific deduplication service path.

The provided CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent: local access and high complexity (race condition) suppress the score below critical despite full CIA impact. No public exploit code is known and the vulnerability is absent from CISA KEV, reducing near-term mass-exploitation risk. However, local privilege escalation primitives of this class are routinely chained after initial access in ransomware and APT operations, so the realistic priority depends on whether adversaries already have a foothold. EPSS data was not provided; given AC:H and the requirement for local access, exploitation probability is expected to be moderate-to-low. The missing EPSS signal should be verified via NVD or FIRST before deprioritizing in high-value Windows Server environments. SSVC assessment: exploitation status 'none', automatable 'no' (race condition), technical impact 'total' - suggesting patching on a normal cycle for most environments but expedited for privileged-server deployments.

An attacker who has obtained a low-privileged shell on a Windows Server 2025 system with ReFS deduplication enabled races to replace a legitimate directory path with a crafted symlink or junction at the moment the Deduplication Service resolves it, redirecting the service's privileged file write to a protected system location such as a driver directory, ultimately achieving SYSTEM-level code execution. No public proof-of-concept is known at this time.