Windows ReFS EUVD-2026-99601

Requires the attacker to already have local, authenticated access to the host as a low-privileged user (CVSS PR:L, AV:L) and the ability to execute code that interacts with the Windows Resilient File System (ReFS) driver. The specific limiting factor is that the vulnerable code path lives in ReFS, so exploitation realistically requires the presence/mounting of a ReFS-formatted volume for the driver to process attacker-controlled input - ReFS is not the default Windows filesystem (NTFS is), which narrows the real-world attack surface on typical client machines while remaining relevant on servers and storage hosts using ReFS. No user interaction is needed (UI:N) and no network exposure exists (local-only), but the required pre-existing foothold and authenticated access meaningfully limit who can exploit it.

This is a credible but non-urgent local privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) describes a locally-exploitable flaw requiring an already-authenticated low-privilege user, with no user interaction and total impact to confidentiality, integrity and availability within the same security scope - consistent with full SYSTEM compromise from a standard account. CISA's SSVC decision data reinforces a measured priority: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-automated, as expected for a local EoP needing a foothold), but Technical Impact=total, which matches the C:H/I:H/A:H rating. There is NO EPSS score, NO KEV listing, and NO public exploit in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (local vector + authenticated + not automatable + no exploitation observed), so this is a genuine patch-soon issue for Windows fleets rather than a drop-everything emergency - most valuable to an attacker as a second-stage escalation primitive after initial access. MISSING DATA: EPSS probability is absent so statistical exploitation likelihood cannot be quantified; the Microsoft MSRC advisory URL is referenced but its specific technical detail (e.g., whether a ReFS volume must be mounted) is not included in the input and should be verified against the vendor guide.

A low-privileged but authenticated user already present on a Windows host (via malware, phishing foothold, or a limited service account) runs a crafted program that drives the Resilient File System (ReFS) driver into a heap-based buffer overflow. By corrupting kernel heap structures the attacker elevates to SYSTEM, gaining full control of the machine. No public exploit is identified at time of analysis, and no user interaction is required once the attacker has local access.