Windows Resilient File System (ReFS): Use after free allows privilege escalation

Summary

A use-after-free flaw in the Windows Resilient File System (ReFS) allows an authorized local attacker to elevate privileges. The attacker needs an existing local account, and the attack complexity is high, so this is a post-compromise risk rather than an internet-facing one. If exploited, the impact on confidentiality, integrity and availability is rated High. The CNA record lists Windows 11 version 26H1 as affected.

Affected

• Microsoft Windows 11 version 26H1 (ARM64 and x64), builds 10.0.28000.0 up to before 10.0.28000.3501
• Unknown: whether other Windows versions or Windows Server are affected.

Fixed in

• Build 10.0.28000.3501 or later, according to the CNA record. Verify the KB number on the MSRC advisory.

Workaround

• Unknown. No workaround is listed in the sources. Install the fixed build.

Exploitation

• Exploited in the wild: no evidence found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Public proof of concept: none found.

Our recommendation

• Install the November 2026 security update that provides build 10.0.28000.3501 or later on affected Windows 11 26H1 systems.
• Check the MSRC advisory for other affected Windows versions and patch them.
• Prioritise shared or multi-user systems, file servers and hosts where local users are not fully trusted.
• Monitor for unexpected privilege escalation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-105509 msrc.microsoft.com
• CVE Record: CVE-2026-105509 www.cve.org
• Strix: CVE-2026-105509 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:46.