A heap‑based buffer overflow in the Windows Resilient File System (ReFS) allows an attacker with sufficient authorization to gain higher privileges on the affected systems. The flaw occurs when ReFS processes user input that can corrupt heap memory, leading to arbitrary code execution or privilege escalation. The attack scenario relies on unvalidated or improper handling of heap data structures, typical of a CWE‑122 vulnerability.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2016, 2019, 2022, and 2025, including Server Core installations and standard client configurations. All listed platforms use ReFS where the flaw is manifest.

The CVSS score of 7.8 indicates high severity, but the EPSS score is not available, limiting precise likelihood assessment. The vulnerability is listed as not part of the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local; an attacker must be authenticated or have the ability to embed malicious data into ReFS volumes. No evidence supports a remote exploitation path without local presence.