CVE-2026-58530

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows Resilient File System (ReFS) implementation, likely within the ReFS kernel-mode file system driver. A local, unauthenticated attacker can trigger memory corruption by causing Windows to process specially crafted ReFS file system data, such as a maliciously prepared volume, virtual disk, removable drive, or disk image. Successful exploitation can result in local code execution with high impact to confidentiality, integrity, and availability, potentially in kernel context depending on the vulnerable code path. The CVSS vector indicates local access, low attack complexity, no privileges required, and required user interaction.

Why it matters to the business

Successful exploitation could allow an attacker who can get a user or system to mount or access a malicious ReFS-formatted volume to take control of the affected Windows system, steal data, disable security controls, install persistence, or cause system crashes. Servers and workstations that handle removable media, virtual hard disks, backup media, developer/test images, or storage operations involving ReFS are higher-risk. Although it is not currently listed in CISA KEV and no public exploit maturity is reported, the vulnerability was published 28 days ago and affects many supported Windows client and server versions, so patching should be prioritized as part of the normal security update cycle.

How an attack unfolds

An attacker prepares a malformed ReFS file system object designed to corrupt heap memory when parsed by Windows. The attacker then delivers or exposes that object through a local attack vector, such as a removable drive, attached disk, virtual hard disk, or other storage image that a user or administrator mounts or opens on an affected Windows system. When the vulnerable ReFS code processes the crafted metadata, the heap overflow is triggered. If the attacker can control the corrupted memory state reliably, exploitation may allow arbitrary code execution locally, potentially with elevated privileges if execution occurs in kernel mode. Failed exploitation attempts may instead produce file system errors, driver crashes, blue screens, or abnormal disk-mount behavior.

How to fix it

Install the applicable Microsoft security update for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft’s official security update guidance for CVE-2026-58530 and deploy the July 2026 or later cumulative update that includes the ReFS fix for each supported platform. Where immediate patching is not possible, reduce exposure by restricting the mounting of untrusted removable media and virtual disks, blocking or tightly controlling VHD/VHDX handling from untrusted sources, limiting administrative storage workflows to trusted media, disabling AutoPlay/AutoRun behaviors, and enforcing endpoint controls that prevent users from mounting unknown disk images. Treat any ReFS-formatted media from external or untrusted sources as hostile until patched systems are used for inspection.

How to confirm the fix worked

Confirm that affected Windows systems have installed the Microsoft cumulative security update that includes the ReFS fix. Validate by checking Windows Update history, installed hotfixes, OS build numbers, and enterprise patch-management compliance reports against Microsoft’s official fixed build information. Verify that the ReFS driver on disk has been updated after patching, and confirm the system has rebooted if required. Operationally, test that controls restrict untrusted removable media and virtual disk mounting where mitigation is needed. For exposure assessment, inventory Windows hosts that support or use ReFS, especially file servers, backup infrastructure, virtualization hosts, developer workstations, forensic workstations, and systems that regularly mount VHD/VHDX or removable storage.

Typical attack path

1. Attacker creates a specially crafted ReFS volume, disk image, virtual hard disk, or removable-media payload containing malformed file system metadata.
2. Attacker convinces a user or operator to attach, mount, open, inspect, restore, or otherwise process the crafted storage object on an affected Windows system.
3. Windows loads or interacts with the ReFS file system driver to parse the malicious file system structures.
4. The malformed ReFS metadata triggers a heap-based buffer overflow in the vulnerable code path.
5. The attacker achieves local code execution or causes a denial-of-service crash, depending on exploit reliability and target conditions.
6. If code execution succeeds, the attacker may attempt privilege escalation, credential theft, persistence, lateral movement, or security-tool tampering.

How to detect it

To determine whether exploitation may already have occurred, review endpoint telemetry and Windows logs for suspicious storage-mount activity followed by crashes, privilege escalation, or unusual process behavior. Relevant sources include Windows System logs, Microsoft-Windows-Kernel-PnP, Microsoft-Windows-Partition, Microsoft-Windows-Storage-ClassPnP, Microsoft-Windows-VHDMP, Microsoft-Windows-DriverFrameworks-UserMode, Microsoft-Windows-WER-SystemErrorReporting, Microsoft-Windows-Windows Error Reporting, PowerShell logs, Sysmon process creation and driver-load events, EDR device-control logs, and removable-media audit logs. Hunt for Mount-DiskImage, diskpart, PowerShell storage cmdlets, or Explorer activity involving untrusted VHD/VHDX or removable drives shortly before system instability. Investigate blue screens, bugchecks, or memory-corruption events referencing refs.sys, ReFS, KERNEL_MODE_HEAP_CORRUPTION, PAGE_FAULT_IN_NONPAGED_AREA, SYSTEM_SERVICE_EXCEPTION, or IRQL_NOT_LESS_OR_EQUAL. Also look for post-exploitation signs after suspicious mount events, including new local admin users, new services, unexpected scheduled tasks, unsigned or newly loaded drivers, credential-dumping tools, disabled security services, and outbound network connections from unusual processes. Because no public exploit maturity or actor-specific indicators are provided, detection should focus on behavioral evidence around untrusted storage processing and subsequent local compromise activity rather than fixed file hashes or network indicators.

• C:\Windows\System32\drivers\refs.sys
• refs.sys
• ReFS
• Mount-DiskImage
• Get-DiskImage
• Dismount-DiskImage
• diskpart.exe
• format fs=refs
• format /fs:refs
• .vhd
• .vhdx
• Microsoft-Windows-VHDMP
• Microsoft-Windows-Kernel-PnP
• Microsoft-Windows-Partition
• Microsoft-Windows-Storage-ClassPnP
• Microsoft-Windows-WER-SystemErrorReporting
• Windows Error Reporting
• BugCheck
• KERNEL_MODE_HEAP_CORRUPTION
• PAGE_FAULT_IN_NONPAGED_AREA
• SYSTEM_SERVICE_EXCEPTION
• IRQL_NOT_LESS_OR_EQUAL
• The computer has rebooted from a bugcheck

What your security team should do

• Prioritize patch deployment to systems that handle removable media, backup media, virtual disks, storage images, or ReFS volumes.
• Deploy the relevant Microsoft cumulative security update for all affected Windows client and server versions and verify reboot completion where required.
• Inventory ReFS usage and identify systems where ReFS-formatted volumes, VHD/VHDX files, or external disks are routinely mounted.
• Temporarily restrict mounting of untrusted VHD, VHDX, removable drive, and externally supplied storage images until patching is complete.
• Disable AutoPlay/AutoRun and enforce endpoint controls for removable media and disk-image handling.
• Increase monitoring for suspicious disk image mounting, unexpected ReFS volume activity, and crashes involving refs.sys.
• Review recent endpoint and Windows event logs for signs of exploitation attempts, including kernel bugchecks, abnormal mount failures, and ReFS driver faults.
• Ensure EDR policies detect suspicious post-exploitation behavior following disk-mount events, such as new services, credential dumping, unsigned driver loads, or security-control tampering.