CVE-2026-105509: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Q: Who is exposed to this vulnerability?

Systems running Microsoft Windows 11 with the Resilient File System (ReFS) component are in scope based on the available data. Exploitation is local, so it does not describe a remote unauthenticated attack path.

Q: What access does an attacker need to exploit it?

An attacker must already be authorized on the affected system and have local access. The attack has high complexity, indicating exploitation requires conditions beyond simply having local authenticated access.

Q: What is the likely impact if exploitation succeeds?

Successful exploitation allows elevation of privilege. The supplied vector indicates high impact to confidentiality, integrity, and availability.

Q: How can I determine whether a system is affected?

Review whether the system is Microsoft Windows 11 and whether ReFS is present or used. The provided data does not identify affected build numbers, fixed versions, or configuration-specific conditions.

Published Nov 10, 2026

Updated

Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Other sources

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

— Microsoft

Affected Software

2 affected componentsFixes available

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Microsoft Windows 11=26H1, >=10.0.28000<10.0.28000.3501

10.0.28000.3501

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3501Patch KB5132059

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:18 PM

Data Sourced

via MITRE·06:18 PM

DescriptionSeverity

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Systems running Microsoft Windows 11 with the Resilient File System (ReFS) component are in scope based on the available data. Exploitation is local, so it does not describe a remote unauthenticated attack path.

What access does an attacker need to exploit it?

An attacker must already be authorized on the affected system and have local access. The attack has high complexity, indicating exploitation requires conditions beyond simply having local authenticated access.

What is the likely impact if exploitation succeeds?

Successful exploitation allows elevation of privilege. The supplied vector indicates high impact to confidentiality, integrity, and availability.

How can I determine whether a system is affected?

Review whether the system is Microsoft Windows 11 and whether ReFS is present or used. The provided data does not identify affected build numbers, fixed versions, or configuration-specific conditions.

CVE-2026-105509: Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need to exploit it?

What is the likely impact if exploitation succeeds?

How can I determine whether a system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need to exploit it?

What is the likely impact if exploitation succeeds?

How can I determine whether a system is affected?