CVE-2025-27738: Windows 10 1507 ReFS Information Disclosure

CVE-2025-27738 Overview

CVE-2025-27738 is an improper access control vulnerability in the Windows Resilient File System (ReFS) that permits an authenticated attacker to disclose sensitive information over a network. The flaw is tracked under CWE-284 (Improper Access Control) and affects a broad range of Windows client and Windows Server releases. Microsoft published the advisory on April 8, 2025.

Exploitation requires network access and low-privilege authentication on the target system, with no user interaction. Successful exploitation results in confidentiality impact only; integrity and availability are not affected.

Critical Impact
An authorized network attacker can read information they should not have access to on ReFS-formatted volumes, potentially exposing file contents or metadata across Windows clients and Windows Server hosts.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-04-08 - CVE CVE-2025-27738 published to NVD
2025-04-08 - Microsoft releases security update via the Security Update Guide
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27738

Vulnerability Analysis

The Resilient File System (ReFS) is Microsoft's next-generation file system, designed for large data volumes with built-in integrity checks. CVE-2025-27738 exists because ReFS enforces access control checks incorrectly for certain remote operations. An attacker with valid credentials on the target host can query resources over the network and receive data that access control lists should have blocked.

The issue falls under CWE-284: Improper Access Control. The vulnerability is an information disclosure primitive rather than a code execution flaw; it does not permit modification of files or denial of service.

Root Cause

The root cause is an authorization gap in the code paths that mediate remote access to ReFS resources. The file system component does not correctly evaluate the caller's permissions before returning file data or metadata for specific request patterns. Because ReFS is used for storage-heavy workloads such as Storage Spaces Direct, Hyper-V VHDX storage, and backup repositories, the returned data can include contents of shared virtual disks and backup files.

Attack Vector

The attacker must have network reachability to a service exposed by the vulnerable Windows host and must be able to authenticate with at least low-privilege credentials. No user interaction is required. Once authenticated, the attacker issues requests that trigger the flawed ReFS access-check path and reads information beyond their authorization boundary. The vulnerability is reachable across all supported Windows client and Windows Server versions running ReFS.

No public proof-of-concept code has been released, and CISA has not added CVE-2025-27738 to the Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2025-27738

Indicators of Compromise

Unexpected authenticated SMB or file-service sessions from low-privilege accounts to hosts backing ReFS volumes.
Sequential or bulk read operations against ReFS-hosted files (VHDX, backup archives, snapshots) that fall outside baseline user behavior.
Access to ReFS resources from accounts that historically have no read relationship with the target share or volume.

Detection Strategies

Correlate Windows Security event IDs 4624 (logon), 4672 (special privileges), 5140 and 5145 (network share access) to identify low-privilege sessions reading sensitive ReFS content.
Baseline normal read volumes per user and per share, then alert on statistically significant deviations against volumes formatted with ReFS.
Hunt for anonymous or generic service accounts touching virtualization or backup repositories hosted on ReFS.

Monitoring Recommendations

Enable object-access auditing on ReFS volumes that store virtual machines, backups, or regulated data.
Forward Windows security, file-share, and SMB telemetry to a centralized analytics platform for cross-host correlation.
Track patch level (build number) for CVE-2025-27738 across every Windows client and server in the environment and alert on unpatched hosts that expose file services.

How to Mitigate CVE-2025-27738

Immediate Actions Required

Apply the April 2025 Microsoft security update referenced in the Microsoft Security Update Guide to every affected Windows client and Windows Server host.
Inventory hosts that use ReFS for Hyper-V storage, Storage Spaces Direct, or backup repositories and prioritize them for patching.
Review authentication logs for low-privilege accounts that recently accessed ReFS resources and validate that access was authorized.

Patch Information

Microsoft addressed CVE-2025-27738 through the cumulative security updates listed in the Microsoft Security Update Guide. Consult the advisory for the specific KB article and build numbers per Windows release, including Windows 10 (1507 through 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2012 through 2025.

Workarounds

Restrict network access to file and SMB services on ReFS-backed hosts using host-based firewalls and network segmentation until patches are deployed.
Enforce least privilege on accounts that can authenticate to storage, virtualization, and backup servers, and disable dormant local accounts.
Require SMB signing and, where supported, SMB encryption to constrain unauthorized reads against ReFS shares.

bash

# Example: enforce SMB signing and encryption on a Windows Server host
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Set-SmbServerConfiguration -EncryptData $true -Force

# Example: block SMB (TCP/445) from untrusted subnets to an ReFS file server
New-NetFirewallRule -DisplayName "Block SMB from Untrusted" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -RemoteAddress 10.0.99.0/24 -Action Block