CVE-2026-50441

What it actually does

This is a local privilege-escalation flaw in the Windows Resilient File System kernel driver. A low-privileged, authenticated attacker can trigger an unsafe pointer dereference in ReFS-related kernel code, potentially allowing code execution in kernel context. Successful exploitation can elevate the attacker from a standard local user context to SYSTEM or equivalent kernel-level privileges, resulting in full confidentiality, integrity, and availability impact on the affected Windows host.

Why it matters to the business

If exploited after an attacker has obtained any local foothold, this vulnerability can turn limited access into full control of a workstation or server. That can enable credential theft, security tool tampering, persistence, lateral movement, ransomware staging, or manipulation of data stored on ReFS-backed systems such as file servers, backup repositories, virtual machine storage, or high-capacity Windows storage volumes. It is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and requires local authenticated access, but its high impact makes timely patching important across affected Windows client and server versions.

How an attack unfolds

An attacker must first obtain local authenticated access to an affected Windows system, such as through stolen credentials, malware execution, remote desktop access, or exploitation of a separate initial-access vulnerability. The attacker then interacts with ReFS functionality from a low-privileged context, potentially by using a ReFS-formatted volume, mounted virtual disk, removable media, storage configuration, or file-system operations that reach the vulnerable ReFS driver path. By supplying crafted inputs that cause the kernel to dereference an untrusted pointer, the attacker attempts to corrupt or influence kernel execution flow. A successful exploit would execute attacker-controlled code with kernel privileges or SYSTEM-level rights. After elevation, the attacker can disable defenses, dump credentials, install persistence, access protected files, move laterally, or prepare destructive actions such as encryption or data wiping.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so remediation should be validated against Microsoft’s official security update guidance and the installed cumulative update level for each affected OS release. Prioritize systems that allow interactive logon, remote administration, developer access, VDI use, file-server access, Hyper-V storage, backup storage, Storage Spaces, or ReFS-mounted volumes. Where immediate patching is not possible, reduce risk by limiting local and RDP logon rights, restricting who can mount virtual disks or removable media, preventing untrusted users from creating or attaching ReFS volumes, enforcing least privilege, applying application control, and monitoring for suspicious local privilege-escalation behavior.

How to confirm the fix worked

Confirm that each affected system has received the relevant Microsoft cumulative security update released after the vulnerability disclosure. Validate the installed Windows build and update revision using standard patch-management tooling, Windows Update history, PowerShell inventory, or endpoint management platforms. Confirm that the ReFS driver on patched systems has been updated to the expected vendor-fixed version according to Microsoft release notes. Where ReFS is used operationally, verify that ReFS volumes mount and function normally after patching. For exposure validation, inventory systems with ReFS volumes or ReFS-capable storage roles and compare their OS build numbers against vendor-fixed levels. For mitigation validation, confirm that non-administrative users cannot mount arbitrary virtual disks, attach untrusted storage, or obtain unnecessary local interactive access.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Identify whether ReFS functionality is present or usable, such as mounted ReFS volumes, virtual disks, storage pools, backup volumes, or server storage roles.
3. Trigger ReFS file-system operations or control paths using crafted inputs designed to reach the vulnerable untrusted pointer dereference.
4. Exploit the kernel memory condition to elevate privileges from a standard user or service account to SYSTEM or kernel-level execution.
5. Use elevated privileges to disable security controls, access sensitive data, harvest credentials, persist, or move laterally.

How to detect it

There are no provided public exploit indicators and the vulnerability is not listed as known exploited in the supplied data, so detection should focus on suspicious behavior and forensic artifacts rather than fixed signatures. Review Windows Security logs, Sysmon, EDR telemetry, Windows Error Reporting, crash dumps, and storage-related operational logs for unusual ReFS, disk, volume, VHD/VHDX, or removable-media activity followed by privilege escalation. Useful log sources include Security Event IDs 4624, 4672, 4688, 4697, 7045, and 1102; Sysmon Event IDs 1, 6, 7, 10, 11, and 12-14; System logs for bugchecks or driver failures; and Microsoft-Windows-Kernel-PnP, Microsoft-Windows-Partition, Microsoft-Windows-VHDMP, Microsoft-Windows-ReFS, and Service Control Manager events. Hunt for low-privileged users launching disk, mount, format, PowerShell, or native API tooling shortly before SYSTEM-level shells, new services, driver loads, LSASS access, endpoint protection tampering, or credential dumping. Failed exploitation may appear as system crashes, bugchecks, Windows Error Reporting events, or dump files referencing refs.sys. Because local privilege escalation is often used after initial compromise, correlate ReFS-related activity with preceding suspicious logons, remote access, malware detections, unusual child processes, or new persistence mechanisms.

What your security team should do

• Patch affected Windows client and server systems as the primary control, prioritizing internet-managed endpoints, shared workstations, RDP-accessible systems, file servers, Hyper-V hosts, backup infrastructure, and systems with ReFS volumes.
• Inventory ReFS usage across Windows estates, including fixed disks, virtual disks, Storage Spaces, backup repositories, and virtualization storage.
• Treat this as a post-compromise privilege-escalation risk: pair patching with controls that reduce initial access, including MFA for remote access, endpoint protection, credential hygiene, and removal of unnecessary local admin rights.
• Restrict the ability of standard users to mount VHD/VHDX files, attach removable storage, or interact with untrusted file-system images where operationally feasible.
• Hunt for recent local privilege-escalation behavior on unpatched systems, especially suspicious process chains that move from a low-integrity or user process to SYSTEM shortly after ReFS, disk, volume, or VHD activity.
• Review crash telemetry and Windows Error Reporting for ReFS-related kernel crashes, as failed exploitation attempts may cause bugchecks or refs.sys faults.
• Increase monitoring on systems where patching must be delayed, and isolate high-value unpatched servers from unnecessary user logon paths.