What is the CVSS score of EUVD-2026-43807?

EUVD-2026-43807 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows ReFS are affected by EUVD-2026-43807?

A local privilege escalation vulnerability (CVE-2026-49792) in Microsoft's ReFS driver affects Windows 10, 11, and Server 2016-2025 installations across potentially thousands of enterprise endpoints…. A patch is available.

How to fix or mitigate EUVD-2026-43807?

Within 24 hours, inventory all Windows 10, Windows 11, and Windows Server 2016-2025 systems across endpoints and servers, prioritizing production infrastructure; determine which systems are running ReFS. Within 7 days, acquire and deploy the available Microsoft patch through Windows Update or Microsoft Update Catalog to production systems, validating ReFS file system functionality post-deployment. Complete patch deployment to all remaining systems within 30 days, including test and development environments, and perform final validation that ReFS integrity operations are functional.

Windows ReFS EUVD-2026-43807

| CVE-2026-49792 HIGH

Numeric Truncation Error (CWE-197)

2026-07-14 microsoft

GHSA-54cf-prcc-99vc

Information Disclosure Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today AI

7.8 HIGH

Local kernel-driver code execution requires an existing low-privileged foothold (AV:L, PR:L), triggers without user interaction at low complexity, and yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:32 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 7.8

DescriptionCVE.org

Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft's Resilient File System (ReFS) driver allows an authorized (low-privileged) attacker to run arbitrary code with elevated context via a numeric truncation flaw. The bug affects the ReFS component shipped with Windows 10, Windows 11, and Windows Server 2016 through 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note that the CVE's own tags label it 'Information Disclosure' while the description and CVSS impact (C:H/I:H/A:H) describe full code execution - the code-execution reading should be treated as authoritative.

Technical ContextAI

ReFS (Resilient File System) is Microsoft's newer-generation filesystem used for Storage Spaces, Dev Drive, and large-volume/data-integrity scenarios on Windows client and server. The root cause is CWE-197 (Numeric Truncation Error): a value is converted into a smaller integer type, discarding high-order bits and yielding a smaller-than-expected result. In a kernel-mode filesystem parser this typically leads to under-allocated buffers or miscalculated lengths/offsets when handling on-disk metadata structures, enabling memory corruption. Because ReFS parsing runs in kernel context, successful exploitation can escalate to arbitrary code execution. The CPE set confirms the affected surface is the OS-bundled ReFS driver across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016/2019 (including Server Core), with tags also naming Server 2022 and Server 2025.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for your specific Windows/Windows Server SKU as published in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49792); exact fixed build numbers are listed there per product and are not reproduced in the input data. Because exploitation involves the ReFS driver, effective compensating controls on unpatched systems include avoiding mounting untrusted or attacker-supplied ReFS volumes/VHDs and restricting the ability of low-privileged users to attach removable or virtual disks (trade-off: may disrupt legitimate removable-media and Dev Drive workflows); on hosts that do not require ReFS, using NTFS instead removes the affected code path from active use (trade-off: loses ReFS-specific integrity and Storage Spaces features). Standard least-privilege hardening reduces the low-privilege foothold the attacker needs, but patching is the only complete fix.