CVE-2026-49793

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows Resilient File System kernel component. A locally authenticated attacker can trigger unsafe memory handling in ReFS and potentially execute code in the local system context. Successful exploitation can provide full local privilege escalation with high confidentiality, integrity, and availability impact, allowing the attacker to bypass normal user privilege boundaries on affected Windows client and server systems.

Why it matters to the business

Although exploitation requires local authenticated access and there is currently no known public exploit maturity or CISA KEV listing, the consequence is severe: an attacker who already has a foothold on a Windows system could become an administrator or SYSTEM-level user. This can enable credential theft, disabling of security tools, tampering with data, ransomware staging, or lateral movement across the environment. Affected platforms include multiple supported Windows 10, Windows 11, and Windows Server releases, so exposure may be broad in organizations with mixed Windows estates.

How an attack unfolds

An attacker first obtains the ability to run code or commands as a low-privileged local user on an affected Windows system. They then interact with ReFS functionality in a way that triggers the heap-based buffer overflow in the ReFS kernel code path. If the memory corruption is shaped successfully, the attacker can redirect execution in kernel context and run attacker-controlled code with elevated privileges. After elevation, the attacker can create or modify privileged accounts, dump credentials, disable defenses, deploy additional tools, access protected files, or use the compromised host as a pivot point. Because the attack is local, it is most relevant after phishing, malware execution, stolen credentials, exposed remote access, or abuse of an existing low-privileged account.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because exact fixed build numbers were not provided in the input, validate remediation against Microsoft’s official update guidance for the relevant OS release and cumulative update channel. Prioritize servers and workstations where untrusted users can log in, systems that process removable or mounted storage, virtualization hosts, developer workstations, jump hosts, and any hosts where ReFS volumes are used. Where immediate patching is not possible, reduce exposure by limiting local interactive logon rights, removing unnecessary standard-user access on servers, restricting the ability to run untrusted executables, enforcing application control, monitoring creation or mounting of unfamiliar volumes and disk images, and ensuring endpoint protection tamper controls are enabled.

How to confirm the fix worked

Confirm that each affected host has installed the Microsoft cumulative security update that includes the fix for this vulnerability. Validate through Windows Update, WSUS, Microsoft Configuration Manager, Intune, vulnerability management tooling, or authenticated host checks. On representative systems, confirm the OS build and ReFS driver version are at or above the vendor-fixed level for that release. Review whether ReFS is present or in use on servers and endpoints, but do not treat absence of visible ReFS volumes as proof that the system is remediated unless the vulnerable component is confirmed patched. Re-run authenticated vulnerability scans after patch deployment and verify that scanners no longer report this issue. For systems that cannot be patched quickly, validate that compensating controls are in place: local logon is restricted, untrusted code execution is blocked, and endpoint telemetry is capturing process creation, privilege changes, driver crashes, and suspicious post-exploitation behavior.

Typical attack path

1. Gain local authenticated access to an affected Windows client or server as a standard user.
2. Run a local exploit or malicious program that exercises vulnerable ReFS functionality.
3. Trigger heap corruption in the ReFS kernel component.
4. Achieve code execution with elevated local privileges, potentially SYSTEM-level privileges.
5. Disable security controls, dump credentials, access sensitive local data, or install persistence.
6. Use the elevated host position for lateral movement, ransomware staging, or further compromise.

How to detect it

There are no reliable public, CVE-specific network indicators for this local privilege escalation issue. Detection should focus on host telemetry and post-exploitation behavior. Review Windows Security, Sysmon, EDR, and crash telemetry for suspicious local processes that run shortly before a privilege jump, unexpected SYSTEM-level process creation, new administrator accounts, changes to local group membership, service or scheduled task creation, credential dumping, or security product tampering. Kernel memory corruption attempts may leave signs such as system instability, bugchecks, ReFS-related driver crashes, or repeated access to ReFS volumes shortly before a crash or privilege escalation event. Useful sources include Windows Security logs, Sysmon process and file events, Microsoft-Windows-Kernel-* logs, Windows Error Reporting, EDR process trees, local administrator group change events, service control manager events, scheduled task events, and file system activity involving ReFS volumes or mounted disk images. Correlate any ReFS-related crash or abnormal volume activity with subsequent SYSTEM process execution, LSASS access, suspicious PowerShell or cmd usage, new services, or account changes. Absence of these artifacts does not prove the vulnerability was not exploited, because successful local kernel exploitation may leave minimal direct evidence.

• C:\Windows\System32\drivers\refs.sys
• refs.sys
• ReFS
• Microsoft-Windows-Refs
• KERNEL_MODE_HEAP_CORRUPTION
• SYSTEM_SERVICE_EXCEPTION
• BugCheck
• Windows Error Reporting
• Event ID 1001
• Event ID 7036
• Event ID 7045
• Event ID 4697
• Event ID 4698
• Event ID 4720
• Event ID 4732
• Event ID 4672
• NT AUTHORITY\SYSTEM
• C:\Windows\System32\lsass.exe

What your security team should do

• Prioritize patching of Windows servers, administrative workstations, virtualization hosts, file servers, and systems with ReFS volumes or local multi-user access.
• Use authenticated vulnerability scanning or endpoint management inventory to identify all affected Windows 10, Windows 11, and Windows Server systems.
• Treat this primarily as a post-compromise privilege escalation risk and hunt for suspicious local privilege escalation followed by credential dumping, security tool tampering, or new persistence.
• Review local administrator group changes, new service creation, scheduled task creation, security control disablement, and unusual SYSTEM-level process launches around the publication and patch window.
• Restrict local interactive logon and remote desktop access to Windows servers to authorized administrators only.
• Enforce application control or allowlisting on high-value systems to reduce the chance that a low-privileged user can execute local exploit code.
• Ensure EDR and Windows event logging capture process creation, command line, service creation, scheduled task creation, driver or kernel crash events, and privilege assignment changes.
• Monitor for exploitation-like sequences: low-privileged process execution followed quickly by SYSTEM-level child processes, LSASS access, credential dumping tools, or endpoint protection tampering.
• Because EPSS is currently low and no KEV listing is present, align patch urgency with exposure and asset criticality, but do not defer beyond normal security update SLAs due to the high impact of successful exploitation.