The vulnerability is an out‑of‑bounds read in the Windows Resilient File System (ReFS) driver. When an attacker, already possessing local user privileges, can interact with a ReFS volume, the defect may expose protected kernel memory. By triggering the read, the attacker can gain higher privileges, effectively allowing local privilege escalation.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including all Server Core editions are vulnerable.

The CVSS score of 7.8 indicates high severity, while the EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and the ability to interact with a ReFS volume; once triggered, the attacker can potentially elevate privileges and compromise the entire system.