CVE-2023-32008: Windows 10 1507 ReFS RCE Vulnerability

CVE-2023-32008 Overview

CVE-2023-32008 is a remote code execution vulnerability in the Windows Resilient File System (ReFS). The flaw is rooted in a NULL pointer dereference condition [CWE-476] within ReFS handling logic. Despite the "remote code execution" classification, the CVSS vector indicates a local attack vector requiring user interaction. An attacker who successfully exploits this vulnerability can execute code in the context of the targeted process and compromise confidentiality, integrity, and availability. The vulnerability affects a broad range of Microsoft Windows client and server operating systems, including Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022.

Critical Impact
Successful exploitation enables code execution with high impact to confidentiality, integrity, and availability on systems using the Resilient File System.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2) — x86, x64, and ARM64
Microsoft Windows 11 (versions 21H2, 22H2)
Microsoft Windows Server 2016, Server 2019, and Server 2022

Discovery Timeline

2023-06-14 - CVE-2023-32008 published to the National Vulnerability Database (NVD)
2025-04-08 - Last updated in the NVD database

Technical Details for CVE-2023-32008

Vulnerability Analysis

The vulnerability resides in the Windows Resilient File System (ReFS), Microsoft's modern file system designed for resiliency, large data volumes, and fault tolerance. ReFS is commonly used on storage servers, Storage Spaces Direct deployments, and Hyper-V hosts. The flaw is categorized as a NULL pointer dereference condition [CWE-476] that leads to code execution rather than a simple denial of service.

Exploitation requires local access and user interaction. An attacker must convince a user to mount or otherwise interact with a maliciously crafted ReFS volume or file system object. Once triggered, the condition allows execution of attacker-controlled code within the kernel-mode file system stack.

Root Cause

The root cause is a NULL pointer dereference [CWE-476] in ReFS parsing or metadata handling routines. The driver fails to validate that a pointer references valid memory before dereferencing it during file system operations. This invalid dereference path is reachable through maliciously crafted file system structures and can be steered into a controllable code execution primitive.

Attack Vector

The attack vector is local with required user interaction. A typical exploitation scenario involves an attacker delivering a malicious ReFS-formatted virtual disk, removable drive, or container image to a target. When the user mounts or accesses the volume, the malformed metadata triggers the dereference in the ReFS driver. Because file system drivers execute in kernel context, successful exploitation grants the attacker the ability to run code with elevated privileges on the host. No verified public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified public proof-of-concept code is available for CVE-2023-32008.
// Refer to the Microsoft Security Response Center advisory for technical details.

Detection Methods for CVE-2023-32008

Indicators of Compromise

Unexpected mounting of ReFS-formatted virtual hard disks (.vhd, .vhdx) or removable media from untrusted sources.
ReFS driver (refs.sys, refsv1.sys) crashes, bug checks, or repeated kernel faults logged in the System event log.
Anomalous kernel-mode process creation following user interaction with external storage media.

Detection Strategies

Monitor Windows Event Logs for kernel-mode crashes referencing the ReFS driver, particularly bug check codes associated with file system corruption.
Inspect endpoint telemetry for Mount-VHD, Mount-DiskImage, or equivalent PowerShell and shell-driven mount operations originating from user sessions.
Correlate volume mount events with subsequent privileged process creation to identify potential post-exploitation activity.

Monitoring Recommendations

Track file system driver load events and integrity of refs.sys across the fleet to catch tampering or unexpected versions.
Alert on attachment of ReFS volumes that arrive via email, downloads, or removable media rather than enterprise-provisioned storage.
Baseline normal ReFS usage in your environment so anomalous mounts on workstations that do not typically use ReFS stand out.

How to Mitigate CVE-2023-32008

Immediate Actions Required

Apply the June 2023 Microsoft security updates that address CVE-2023-32008 to all affected Windows 10, Windows 11, and Windows Server systems.
Inventory hosts and virtual machines that use ReFS volumes and prioritize patching of storage servers, Hyper-V hosts, and backup infrastructure.
Restrict the ability of standard users to mount untrusted virtual disks or removable media on managed endpoints.

Patch Information

Microsoft released a security patch through the standard Windows Update channels. Administrators should consult the Microsoft Security Update for CVE-2023-32008 for the specific KB numbers that apply to each supported Windows version and install them through Windows Update, WSUS, or the Microsoft Update Catalog.

Workarounds

Block the mounting of virtual hard disks (.vhd, .vhdx) by non-administrative users through Group Policy and Attack Surface Reduction rules.
Disable USB and removable media auto-mount on systems that do not require external storage access.
Where ReFS is not required, avoid formatting new volumes with ReFS and prefer NTFS until patches are deployed across the environment.

bash

# Verify installed updates and ReFS driver version on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Get-Item C:\Windows\System32\drivers\refs.sys | Select-Object Name, VersionInfo

# Restrict mounting of virtual disks for non-administrators (example)
# Configure via Group Policy: Computer Configuration > Administrative Templates >
# System > Removable Storage Access