A weakness in the authentication mechanism of the Windows Resilient File System (ReFS) Deduplication Service gives an attacker who already has local access the ability to elevate privileges. By authenticating to the service with insufficient checks, the attacker can gain higher rights on the target machine, potentially enabling full system compromise. This flaw is a classic example of a local privilege escalation vulnerability characterized by CWE-1390, which describes failures to properly enforce privileged operations. The impact is limited to the host where the attacker has some level of local presence; it does not allow remote exploitation or cross‑machine compromise on its own.

The flaw affects Microsoft Windows 11 in the 23H2, 24H2, 25H2, 26H2, and 26H1 releases, as well as Windows Server 2025, including Server Core installations. All contemporary 64‑bit and ARM64 builds of these operating systems are listed as vulnerable, so any installation of the affected editions that has the ReFS Deduplication Service running is at risk.

With a CVSS score of 7.8 the vulnerability is classified as high severity. Exploitation requires local access and a trusted user context, but the weak authentication check removes most barriers for privilege escalation within that user. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that large‑scale exploitation is not yet documented. Nonetheless, the attack can be performed with locally available tools and does not require remote network exposure, making it a practical risk for compromised endpoints.