Executive brief
A security vulnerability exists in the Windows Resilient File System (ReFS), a component used for managing data storage and ensuring data integrity. An attacker who successfully exploits this flaw could execute malicious code on a target system, potentially leading to a full system takeover or data theft. While the attack requires a user to perform an action, such as opening a malicious file, it does not require the attacker to have prior administrative privileges.
Technical details
This vulnerability is classified as a stack-based buffer overflow (CWE-121) within the Windows Resilient File System (ReFS) driver. The flaw is triggered when the system processes specially crafted file system metadata. Although the attack vector is local, it requires no prior privileges (PR:N), though it does necessitate user interaction (UI:R), such as mounting a malicious virtual disk or accessing a compromised storage medium. Successful exploitation allows for arbitrary code execution in the context of the kernel or a highly privileged process. Microsoft has released security updates to address this issue across affected versions of Windows 11 and Windows Server 2025.
Affected products
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2525
- Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158
Timeline
- 2026-07-14: disclosed: Initial advisory published by Microsoft and NVD.
- 2026-07-14: patched: Security updates made available by Microsoft.