EUVD-2026-44108
GHSA-x9fx-332r-9473
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical access is the sole prerequisite (AV:P, PR:N); once on-site, no complexity or interaction barriers exist, and full C/I/A compromise is achievable.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code with a physical attack.
AnalysisAI
Heap-based buffer overflow in the Windows Resilient File System (ReFS) driver enables an unauthorized attacker with physical access to the target machine to execute arbitrary code, achieving full compromise of confidentiality, integrity, and availability. The vulnerability spans a wide range of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. No public exploit or active exploitation has been identified (SSVC: Exploitation none), and Microsoft has released patches; however, the physical attack vector (AV:P) is the dominant risk-shaping factor.
Technical ContextAI
ReFS (Resilient File System) is Microsoft's modern alternative to NTFS, designed for fault tolerance and large data volumes; it ships as an available file system driver across Windows 10, Windows 11, and Windows Server editions. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the ReFS driver fails to properly validate input size or boundary conditions during parsing or processing of file system metadata, allowing more data to be written to a heap-allocated buffer than it can hold. This class of vulnerability can corrupt adjacent heap structures, enabling attacker-controlled memory writes that may redirect execution flow. The CPE data confirms the affected scope as microsoft:windows_10 (versions 1607, 1809, 21H2, 22H2), microsoft:windows_11 (versions 24H2, 25H2, 26H1), and microsoft:windows_server (2016, 2019, 2022, 2025), including Server Core installations.
RemediationAI
Apply the vendor-released patch from Microsoft as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50492. Patched builds per EUVD data are: Windows 10 1607 / Server 2016 build 10.0.14393.9339 or later; Windows 10 1809 / Server 2019 build 10.0.17763.9020 or later; Windows 10 21H2 build 10.0.19044.7548 or later; Windows 10 22H2 build 10.0.19045.7548 or later; Windows 11 24H2 / Server 2025 build 10.0.26100.8875 (client) or 10.0.26100.33158 (server) or later; Windows 11 25H2 build 10.0.26200.8875 or later; Windows 11 26H1 build 10.0.28000.2525 or later; Windows Server 2022 build 10.0.20348.5386 or later. Where patching is not immediately feasible, enforce strict physical access controls - lock server room access, disable or remove USB and external storage ports via Group Policy (Computer Configuration > Administrative Templates > System > Removable Storage Access), and enable BitLocker to protect ReFS volumes at rest. Note that disabling removable storage may impact legitimate operational workflows and should be tested before broad deployment.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today