The flaw is a stack‑based buffer overflow (CWE‑121) in the Windows Resilient File System (ReFS). An attacker with sufficient privileges can trigger the overflow, causing the system to bypass an internal security guard that otherwise protects the integrity or confidentiality of ReFS volumes. The vulnerability is limited to the ReFS code path; exploitation does not immediately grant system‑wide control but enables an attacker to weaken the safeguards that prevent tampering with ReFS data. The issue affects Microsoft Windows 11 in the 24H2, 25H2, 26H1 and 26H2 releases, including arm64‑based builds, as well as Windows Server 2025 in all editions, including Server Core. The advisory specifies that the vulnerability can only be exercised when the attacker has physical access to the machine or the storage media, so it is relevant to environments with exposed or unmanaged disks. With a CVSS score of 4.2, the attack is considered low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because a physical attack is required, the likelihood of exploitation from the network is virtually nil; however, once an attacker has local or physical foothold, the ReFS bypass could be used to subvert defensive controls within that environment.

The affected vendors and products include Microsoft Windows 11 versions 24H2, 25H2, 26H1, and 26H2 (both x64 and arm64 builds where applicable), as well as Windows Server 2025 in all editions, including Server Core installations. These releases are explicitly listed in the Microsoft security advisory and the referenced CPE strings.

With a CVSS score of 4.2, the attack is considered low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because a physical attack is required, the likelihood of exploitation from the network is virtually nil; however, once an attacker has local or physical foothold, the ReFS bypass could be used to subvert defensive controls within that environment.