The flaw is an untrusted pointer dereference in the Windows Resilient File System (ReFS). When processed, the kernel trusts data from a ReFS volume and dereferences a pointer that can be manipulated by an attacker who has local access. Exploitation allows the attacker to gain higher privileges on the system, effectively elevating the user’s credentials from a standard account to an administrative one. This weakness is classified as CWE‑822 and presents a clear escalation of authority without needing remote access.

The vulnerability impacts multiple Microsoft Windows builds. The affected consumer operating systems are Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 24H2, 25H2, and 26H1. Server deployments that are affected include Windows Server 2016 (full and Server Core), Windows Server 2019 (full and Server Core), Windows Server 2022, and Windows Server 2025 (full and Server Core). All listed systems use the ReFS file system, which is the component that contains the vulnerable code.

The CVSS score of 7.8 indicates a high severity local privilege escalation burden. EPSS is reported as < 1 %, suggesting that, while the vulnerability exists, it is unlikely to be widely exploited at present. The vulnerability is not listed in CISA’s KEV catalog, further indicating limited exploitation activity. The attack vector is inferred to be local: an attacker who can write or manipulate a ReFS volume file that the system will later read. Such an attacker could trigger the dereference during normal system operations, altering object ownership or permission bits. The limited attack surface and lack of remote exploitation pathways reduce the immediate risk, but the high CVSS still warrants prompt response.