Executive brief
A security vulnerability exists in the Windows Resilient File System (ReFS), a component used to manage and protect large amounts of data on Windows systems. An attacker with physical access to a computer could exploit this flaw to run unauthorized code, potentially leading to full control over the device or data theft. This risk is primarily relevant for lost or stolen laptops and workstations where an attacker can interact directly with the hardware.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Windows Resilient File System (ReFS) driver. The vulnerability is triggered via a physical attack vector, likely involving the connection of a malicious storage device or the manipulation of an existing ReFS partition. An attacker with physical access to the target system can exploit this to achieve arbitrary code execution with high privileges. Microsoft has released security updates for various versions of Windows 10, Windows 11, and Windows Server to address this issue.
Affected products
- Microsoft Windows 10 Versions 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 Versions 24H2, 25H2, 26H1
- Microsoft Windows Server 2016 All versions
Timeline
- 2026-07-14: disclosed: Initial publication of the CVE record
- 2026-07-14: advisory: Microsoft released security updates and advisory details