This flaw is a heap‑based buffer overflow in the Windows Resilient File System (ReFS). The vulnerability permits an attacker with local, authorized access to execute arbitrary code, giving full control over the affected system. The weakness is a classic memory corruption scenario (CWE‑122) that does not directly expose data but can be leveraged to alter program flow and compromise system integrity.

The issue affects numerous Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2016, 2019, 2022, and 2025 (both full and Server Core installations).

The CVSS base score of 7.8 classifies the vulnerability as high severity, while the EPSS score is 0.00318 (0.32%), indicating a very low likelihood of exploitation. It is not listed in CISA’s KEV catalog, suggesting it has not been actively exploited in the wild. The likely attack vector is a local, authorized user reaching the vulnerable code path, which underscores the importance of preventing privileged account misuse.