CVE-2026-83952: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 11 Version 24H2

This vulnerability involves a heap-based buffer overflow in the Windows Resilient File System (ReFS) on Windows 11 Version 24H2. An attacker with local authorized access can exploit this flaw to elevate their privileges, potentially gaining higher system rights. The vulnerability affects multiple builds of Windows 11 Version 24H2, specifically versions from 10.0.26100.0 up to but not including 10.0.26100.9445, 10.0.26200.0 up to but not including 10.0.26200.9445, 10.0.28000.0 up to but not including 10.0.28000.2954, and 10.0.26100.0 up to but not including 10.0.26100.33438. Microsoft has published an official security update to remediate this vulnerability.

Successful exploitation of this heap-based buffer overflow can lead to local privilege escalation, allowing an attacker with authorized local access to gain elevated privileges. This could compromise system integrity, confidentiality, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for Windows 11 Version 24H2 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83952. Applying these updates will mitigate the vulnerability.