CVE-2025-62456: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network.
Other sources
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.7462Fixed in 10.0.26100.7392Patch KB5072014 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.6345Patch KB5071417 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.7462Fixed in 10.0.26200.7392Patch KB5072014 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.4529Fixed in 10.0.20348.4467Patch KB5071413 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.25398.2025Patch KB5071542
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62456?
CVE-2025-62456 has a critical severity rating due to its potential to allow remote code execution.
How do I fix CVE-2025-62456?
To fix CVE-2025-62456, apply the patches provided by Microsoft for any affected versions of Windows.
What systems are impacted by CVE-2025-62456?
CVE-2025-62456 affects Microsoft Windows Server 2025 and Windows 11 versions 23H2, 24H2, and 25H2.
Can CVE-2025-62456 be exploited remotely?
Yes, CVE-2025-62456 allows an authorized attacker to execute code over a network.
What is the nature of the vulnerability in CVE-2025-62456?
CVE-2025-62456 is a heap-based buffer overflow vulnerability in the Windows Resilient File System (ReFS).