CVE-2026-50318

What it actually does

This is a local privilege escalation vulnerability caused by a stack-based buffer overflow in the Windows Resilient File System driver. An attacker who already has valid low-privileged local access can trigger unsafe memory handling in ReFS-related code paths, potentially corrupting kernel memory and executing code with elevated, likely kernel-level or SYSTEM privileges. Successful exploitation can provide full confidentiality, integrity, and availability impact on the affected Windows host.

Why it matters to the business

A successful attack allows a non-administrative user or malware already running on a Windows workstation or server to gain full control of that system. This can enable credential theft, security tooling tampering, lateral movement, data manipulation, service disruption, and persistence. The issue affects multiple supported Windows client and server releases, including Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025. It is not currently listed in CISA KEV, has no reported ransomware association, and has a low EPSS score, but the CVSS 7.8 rating means it should still be prioritized for standard operating system patch cycles, especially on multi-user servers, developer workstations, VDI, and systems where untrusted local code may execute.

How an attack unfolds

An attacker first obtains the ability to run code locally with a low-privileged account, such as through phishing, stolen credentials, malware execution, abuse of a user session, or access to a shared workstation or server. The attacker then interacts with ReFS functionality in a way that reaches the vulnerable stack-based buffer handling logic, for example through crafted file system operations, metadata interactions, or use of a specially prepared ReFS-backed volume where applicable. If exploitation succeeds, the overflow corrupts stack memory inside the Windows file system driver and redirects execution into attacker-controlled logic. Because the vulnerable component operates in a privileged Windows context, the attacker can elevate from a normal user to SYSTEM or equivalent control, after which they may disable defenses, dump credentials, install persistence, modify files, or move laterally. No public mature exploit is indicated in the provided data, so defenders should treat exploitation as plausible but not currently known to be widespread.

How to fix it

Apply the applicable Microsoft security update or latest cumulative update for all affected Windows versions: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; and Windows Server 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, WSUS, Intune, Configuration Manager, or the Microsoft Security Update Guide to identify the current patched build for each OS release. Where immediate patching is not possible, reduce exposure by limiting local interactive access, preventing untrusted users from running code, restricting access to ReFS volumes, blocking untrusted removable media and untrusted virtual disk mounting where operationally feasible, enforcing least privilege, and monitoring for local privilege escalation behavior. Mitigations should be considered temporary; the primary fix is to install the vendor update.

How to confirm the fix worked

Confirm that every affected Windows asset has received the relevant cumulative security update released for this vulnerability or a later cumulative update. Validate through centralized patch management reporting, endpoint inventory, vulnerability scanning, and local OS build verification using supported Microsoft tooling. For higher assurance, verify that the ReFS driver on patched systems has a file version and signature consistent with the post-fix Microsoft update for that OS branch. Also confirm that systems requiring reboot after update installation have actually rebooted, because kernel driver fixes may not be active until restart. Where ReFS is used operationally, perform normal storage and application regression checks after patching.

Typical attack path

1. Gain low-privileged local access to an affected Windows client or server.
2. Determine whether the host exposes usable ReFS functionality or ReFS-backed storage paths.
3. Deliver or run exploit code that triggers the vulnerable ReFS stack-based buffer overflow through crafted local file system interactions.
4. Corrupt privileged memory in the ReFS driver context and achieve elevated code execution.
5. Spawn or inject into a privileged process, commonly with SYSTEM-level rights.
6. Disable security controls, harvest credentials, establish persistence, or use the host as a foothold for lateral movement.

How to detect it

Because this is a local kernel-level privilege escalation issue and no mature public exploit or campaign-specific indicators are provided, detection should focus on behavioral evidence and crash artifacts rather than fixed network signatures. Review Windows Security logs for suspicious local logons followed by privilege changes, new service creation, scheduled task creation, credential dumping attempts, or security control tampering. Examine Sysmon or EDR telemetry for low-privileged processes spawning SYSTEM-level processes, unexpected command shells, PowerShell, rundll32, regsvr32, or service-control activity shortly after ReFS volume access or mounting activity. Review System, Application, Windows Error Reporting, kernel dump, and EDR crash telemetry for faults, bugchecks, or exceptions involving ReFS.sys, especially repeated crashes or crashes near suspicious local user activity. Investigate newly mounted VHD/VHDX files, removable media, or unusual ReFS-formatted volumes if such events precede privilege escalation behavior. Since exploitation occurs locally, network logs are unlikely to show the exploit itself, but they may show follow-on activity such as lateral movement, remote service creation, SMB admin share access, credential use from the compromised host, or outbound command-and-control traffic.

• ReFS.sys
• refs.sys
• C:\Windows\System32\drivers\ReFS.sys
• \SystemRoot\System32\drivers\ReFS.sys
• FAULTING_MODULE: ReFS.sys
• Probably caused by : ReFS.sys
• BugCheck
• Event ID 1001
• Windows Error Reporting
• Event ID 7045
• Event ID 4697
• Event ID 4672
• Event ID 4688

What your security team should do

• Prioritize patching multi-user Windows servers, VDI hosts, jump boxes, developer workstations, and any systems where low-privileged users or untrusted code can run.
• Use enterprise patch tooling to identify affected Windows 10, Windows 11, and Windows Server versions and deploy the latest cumulative updates.
• Track reboot compliance after patch deployment because the vulnerable kernel component may remain loaded until restart.
• Harden local access by limiting interactive logon rights, removing unnecessary local administrator paths, and enforcing application control where possible.
• Monitor for suspicious local privilege escalation behavior, including unexpected SYSTEM shells, unsigned drivers, abnormal child processes from user-writable locations, and security tool tampering.
• Review crash telemetry and Windows event logs for ReFS.sys-related faults or bugchecks, especially when correlated with suspicious user activity or newly mounted storage.
• Do not defer solely because EPSS is low or the issue is not in KEV; local privilege escalation bugs are commonly chained after initial access.