Listen to this Post
CVE-2026-50357 is a critical elevation of privilege vulnerability residing in the Windows Resilient File System (ReFS) kernel component. The flaw is classified as a numeric truncation error (CWE-197) – a type of software weakness where a value is converted from a larger data type to a smaller one, resulting in the loss of high‑order bits and producing an unexpectedly small or zeroed value.
In the context of ReFS, this truncation occurs during the processing of file system metadata or storage allocation parameters. ReFS is designed to handle massive volumes (up to 2⁶⁴ bytes) and uses 64‑bit integers extensively for block addresses, file offsets, and allocation sizes. When a 64‑bit value is improperly cast to a 32‑bit integer without proper validation, the truncated result can lead to:
– Corrupted internal state – the kernel driver uses the truncated value to index into critical tables or to calculate buffer sizes.
– Out‑of‑bounds memory access – a small truncated index may point outside the intended array, allowing an attacker to read or write kernel memory.
– Privilege escalation – by carefully controlling the truncated value, an authenticated local attacker can overwrite kernel structures (e.g., token privileges, process credentials) and gain SYSTEM or administrative rights.
The attack vector is local (AV:L) and requires low privileges (PR:L) – meaning any authenticated user with minimal rights can trigger the vulnerability. No user interaction is needed (UI:N), and the attack complexity is low (AC:L). The CVSS base score assigned by Microsoft is 7.8 (High) , with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating full impact on confidentiality, integrity, and availability.
Affected products span a wide range of Windows client and server versions, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2016, 2019, 2022, and 2025. The vulnerability was publicly disclosed on July 14, 2026, and a patch was released as part of the monthly Patch Tuesday update.
DailyCVE Form
| Field | Value |
|–|–|
| Platform | Microsoft Windows |
| Version | 10, 11, Server 2016/2019/2022/2025 |
| Vulnerability | Numeric Truncation Error (CWE‑197) |
| Severity | High (CVSS 7.8) |
| Date | 2026‑07‑14 |
| Prediction | Patch released 2026‑07‑14 |
What Undercode Say
Analytics
- EPSS – Not yet available (as of July 2026).
- Exploit Price – Estimated between $25,000 and $100,000 on underground markets.
- CTI Interest Score – Elevated (1.37 out of 2.0) due to the high impact and local attack surface.
- MITRE ATT&CK – Mapped to T1548.002 (Abuse Elevation Control Mechanism: Create Process with Token).
Detection & Verification Commands
Check if the system has a ReFS volume mounted and its driver version:
fsutil fsinfo refsinfo X:
(Replace `X:` with the drive letter of a ReFS volume.)
List all ReFS volumes and their metadata block size (should be 16KB):
Get-Volume | Where-Object FileSystem -eq "ReFS" | Format-List
Verify the installed Windows update that addresses CVE-2026-50357 (KB number varies by build):
Get-HotFix | Where-Object HotFixID -Match "KB50"
Check the ReFS driver file version (refs.sys located in C:\Windows\System32\drivers\):
wmic datafile where name="C:\Windows\System32\drivers\refs.sys" get Version
The patched version should be 10.0.14393.9339 or higher (Windows 10 1607), 10.0.17763.9020 or higher (Windows 10 1809), 10.0.19044.7548 or higher (Windows 10 21H2/22H2), 10.0.26100.8875 or higher (Windows 11 24H2), and 10.0.26200.8875 or higher (Windows 11 25H2).
PoC Snippet (Conceptual)
The following pseudo‑code illustrates how a truncated length value could be abused:
// Vulnerable ReFS kernel function (simplified)
NTSTATUS RefsProcessMetadata(PLARGE_INTEGER pOffset, ULONG pSize) {
ULONG truncatedSize = (ULONG)pOffset->QuadPart; // 64→32 truncation
if (truncatedSize > MAX_BUFFER) {
return STATUS_INVALID_PARAMETER;
}
// Allocate buffer based on truncated size
PVOID buffer = ExAllocatePoolWithTag(NonPagedPool, truncatedSize, 'refs');
// Read metadata from disk into buffer – out‑of‑bounds if pOffset was large
...
}
An attacker would craft a malicious ReFS volume where a metadata block contains a 64‑bit offset that, when truncated, yields a small value, bypassing bounds checks and leading to a kernel pool overflow or arbitrary write.
Exploit
At the time of writing, no public exploit is available. However, the vulnerability is considered easy to exploit locally:
1. Prerequisites – The attacker must have valid local credentials and the ability to mount or access a ReFS volume (e.g., via a USB drive, network share, or by creating a malicious VHDX file).
2. Trigger – By invoking specific file system operations (e.g., CreateFile, ReadFile, or `DeviceIoControl` with ReFS‑specific IOCTLs) on a specially crafted ReFS volume, the attacker can cause the kernel driver to process a truncated numeric value.
3. Privilege Escalation – The resulting memory corruption allows the attacker to overwrite a kernel object (e.g., the `_EPROCESS` structure of their own process) to elevate its token to SYSTEM.
4. Stealth – The attack is entirely local and leaves minimal forensic traces, as it does not require network connectivity or user interaction.
Given the estimated exploit price ($25k–$100k) and the high CTI interest, it is highly likely that weaponised exploits will emerge within the coming weeks.
Protection
- Apply Official Patch – Install the July 2026 Patch Tuesday updates from Microsoft. The update addresses the truncation error by introducing proper bounds checking and using safe integer conversion routines (
RtlULongLongAdd,RtlULongLongMult, etc.) in the ReFS driver. - Disable ReFS if Unused – If ReFS is not required, disable the feature via:
Disable-WindowsOptionalFeature -Online -FeatureName ReFS
or prevent mounting of ReFS volumes by setting the registry key:
HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\RefsDisableVolumeMount = 1
- Restrict Local Access – Limit the number of local users with interactive logon rights. Use the principle of least privilege (PoLP) to minimise the attack surface.
- Enable Attack Surface Reduction (ASR) – Use Microsoft Defender ASR rules to block processes from creating or modifying ReFS volumes.
- Monitor for Anomalies – Enable auditing for file system events (Event ID 4656, 4663) and watch for unexpected access to ReFS volumes from non‑administrative accounts.
Impact
- Confidentiality – An attacker can read sensitive kernel memory, including passwords, cryptographic keys, and other user data.
- Integrity – By gaining SYSTEM privileges, the attacker can modify system files, registry hives, or security policies, effectively taking full control of the machine.
- Availability – The attacker can crash the system (BSOD) by corrupting critical kernel structures, or install persistent backdoors that survive reboots.
- Lateral Movement – Although the initial vector is local, a compromised machine can be used as a pivot point to move laterally within a corporate network, especially if the attacker obtains domain credentials from LSASS memory.
- Business Impact – For organisations relying on ReFS for large‑scale storage (e.g., Hyper‑V, SQL Server, or file servers), a successful exploit could lead to data loss, service downtime, and regulatory fines.
Criticality – Given the ease of exploitation and the wide range of affected Windows versions, this vulnerability should be patched immediately in all production environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
