CVE-2026-54109

What it actually does

This is a local memory-corruption vulnerability in the Windows Resilient File System (ReFS) implementation. An integer overflow or wraparound can cause incorrect size, offset, or allocation calculations inside ReFS handling, potentially leading to out-of-bounds memory access and arbitrary code execution on the local system. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact. Successful exploitation would most likely result in code execution with elevated privileges, potentially in kernel or highly privileged local context, depending on the vulnerable code path.

Why it matters to the business

An attacker who already has a foothold on a Windows workstation or server could use this flaw to escalate privileges, disable security controls, access sensitive data, install persistent malware, or move laterally. This is especially relevant for Windows servers and endpoints that use or process ReFS volumes, virtual disks, backup repositories, or storage workflows. It is not currently listed in CISA KEV, has no known ransomware association in the provided data, and has low EPSS at this time, but the impact is high if exploited because it can turn limited local access into full system compromise.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system, such as through stolen credentials, malware execution, remote desktop access, or compromise of a lower-privileged account. The attacker then triggers vulnerable ReFS processing using crafted filesystem operations, a crafted ReFS volume, a mounted disk image, or another local interaction that reaches the vulnerable integer calculation. The overflow or wraparound causes ReFS to mis-handle memory, which the attacker attempts to shape into controlled memory corruption. If reliable exploitation is achieved, the attacker executes code locally with elevated privileges, then typically creates or injects into a privileged process, disables defenses, dumps credentials, installs persistence, or pivots to additional systems.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so remediation should be validated against Microsoft’s official update guidance for the relevant release channel. Prioritize systems that use ReFS for production storage, backups, virtualization workloads, removable media workflows, or administrative file processing. Where immediate patching is not possible, reduce exposure by limiting local interactive access, restricting who can mount or attach virtual disks and removable storage, monitoring ReFS volume activity, enforcing least privilege, and ensuring endpoint detection controls are active.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative or security update that includes the ReFS fix. Validate OS build and patch level using standard enterprise patch management, Windows Update history, Microsoft Defender Vulnerability Management, SCCM/Configuration Manager, Intune, WSUS, or equivalent tooling. On high-risk systems, verify the installed ReFS driver version against Microsoft’s advisory or file manifest once available, typically for C:\Windows\System32\drivers\refs.sys. Confirm that ReFS-related storage, backup, and virtualization workflows continue to function after patching. To assess exposure, inventory systems running affected Windows versions and identify those with ReFS volumes, mounted ReFS media, backup repositories using ReFS, or roles that routinely attach virtual disks.

Typical attack path

1. Gain local authenticated access to an affected Windows 10, Windows 11, or Windows Server system.
2. Identify whether ReFS is present, enabled, or reachable through local storage, removable media, virtual disks, backup storage, or mounted images.
3. Prepare crafted ReFS-related input or filesystem activity designed to trigger the integer overflow or wraparound condition.
4. Trigger the vulnerable ReFS code path locally without requiring user interaction.
5. Convert the resulting memory corruption into elevated local code execution.
6. Run post-exploitation actions such as credential theft, security tool tampering, persistence, data staging, or lateral movement.

How to detect it

There are no universally reliable indicators that prove exploitation from logs alone, because this is a local memory-corruption issue in a Windows filesystem component and successful exploitation may leave only post-exploitation traces. Hunt across Windows Security logs, Sysmon, EDR telemetry, Windows Error Reporting, crash dumps, and System event logs. Look for ReFS-related crashes, bugchecks, or application failures involving refs.sys shortly before suspicious privilege changes. Correlate any ReFS volume mounting, virtual disk attachment, removable media use, backup repository access, or unusual filesystem activity with subsequent SYSTEM-level process creation, credential access, LSASS interaction, service creation, scheduled task creation, driver loading, endpoint protection tampering, or unexpected local administrator membership changes. Relevant Windows events include process creation events such as Security 4688 or Sysmon Event ID 1, service installation events such as System 7045, scheduled task activity, privilege assignment events, local group membership changes, and crash or bugcheck events. If crash dumps are available, inspect for faults in or near refs.sys and for anomalous user-controlled data influencing ReFS code paths. Absence of these artifacts does not rule out exploitation.

What your security team should do

• Patch affected Windows endpoints and servers according to Microsoft guidance, prioritizing systems using ReFS or handling storage, backup, or virtual disk workflows.
• Inventory ReFS usage across Windows servers and workstations, including backup targets, Hyper-V storage, mounted VHD/VHDX files, removable media, and administrative file-processing systems.
• Restrict local administrative rights and limit the ability of standard users to mount disk images, attach removable storage, or perform sensitive storage operations.
• Increase monitoring for suspicious local privilege escalation behavior, especially low-privileged processes spawning elevated shells, security tool tampering, credential dumping, or unexpected SYSTEM-level execution.
• Review crash telemetry and Windows Error Reporting for ReFS-related crashes or bugchecks, especially involving refs.sys, around the time of suspicious local activity.
• Because the vulnerability is not currently KEV-listed and EPSS is low, prioritize based on asset criticality and ReFS exposure rather than internet exposure alone.
• Maintain tested recovery procedures and offline backups, since successful local privilege escalation can enable destructive actions even when the initial vulnerability is not remotely exploitable.