Technical impact
Improper link resolution before file access in the Windows ReFS Deduplication Service allows an authorized local attacker to elevate privileges. The flaw arises from the service following links without proper validation, enabling a user with file system access to trigger privileged operations. This can compromise confidentiality, integrity, or availability by allowing unauthorized execution of processes with elevated rights.
Affected Systems
Microsoft Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 (including Server Core) are affected. These operating system editions expose the ReFS Deduplication Service to the described flaw, and any machine running these OS versions with the service enabled is vulnerable.
Risk and Exploitability
The CVSS score of 7 indicates a moderate to high severity. EPSS data is not available, so the exploitation probability is not assessed. The vulnerability is not listed in the CISA KEV catalog, implying no known exploitation at the time of publication. The attack vector appears to be local, requiring an authorized attacker with access sufficient to manipulate ReFS links. Successful exploitation could lead to privilege escalation on the local system.
