CVE-2026-69617 Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally

Description

Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Affected products and versions

Product	Affected versions	Fixed in
Windows 11 version 26H1 10.0	10.0.28000.0 → < 10.0.28000.2954	10.0.28000.2954
Windows Server 2025 10.0	10.0.26100.0 → < 10.0.26100.33438	10.0.26100.33438
Windows Server 2025 (Server Core installation) 10.0	10.0.26100.0 → < 10.0.26100.33438	10.0.26100.33438

Other CVEs of Windows 11 version 26H1

The 2573 CVEs of Windows 11 version 26H1 →

CVE-2026-108463 Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security… 8.8 High CVE-2026-108136 Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally 7.8 High CVE-2026-105016 Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network 9.8 Critical CVE-2026-108135 Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to… 7.0 High