Windows ReFS EUVD-2026-43807

Exploitation requires local access to an affected Windows/Windows Server host and low-level privileges (CVSS PR:L), meaning the attacker must already be an authenticated/authorized local user or have code running on the machine - this is not remotely exploitable over the network. The specific trigger is processing of malicious ReFS on-disk metadata, so exploitation in practice requires either the ReFS driver being active on an existing volume or the attacker being able to get a crafted ReFS volume (e.g., a VHD or removable disk) mounted and parsed. Limiting factors: the host must actually use or mount ReFS, and the attacker needs a pre-existing local foothold; systems that never mount untrusted ReFS media and that restrict disk-attach privileges materially reduce realistic risk.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. This is a classic local privilege-escalation/code-execution profile rather than a remotely wormable issue: an attacker must already have a foothold on the machine (or induce mounting of a crafted ReFS volume). No EPSS score was provided; the vulnerability is not in CISA KEV and no POC is referenced, so exploitation is neither confirmed active nor publicly demonstrated. The signals are internally consistent (local vector matches 'execute code locally') with one caveat: the metadata tags classify this as 'Information Disclosure,' which conflicts with the code-execution description and the full C/I/A impact - defenders should treat it as a code-execution/EoP issue and verify scope against the Microsoft advisory. Overall this is a real patch-priority item for any host using ReFS, but not an emergency internet-facing exposure.

A low-privileged user already logged onto a Windows host (or one who convinces a victim to mount an attacker-crafted ReFS volume such as a malicious VHD or removable disk) triggers the numeric truncation flaw during metadata parsing, corrupting kernel memory to execute code with elevated privileges. Because the vector is local with low complexity and no user interaction, exploitation is reliable once local access is obtained. No public POC is referenced, so an attacker would need to develop the exploit independently.