CVE-2025-62456 Overview
CVE-2025-62456 is a heap-based buffer overflow [CWE-122] in the Windows Resilient File System (ReFS). An authenticated attacker can exploit the flaw over a network to execute arbitrary code on affected Windows 11 and Windows Server systems. Microsoft assigned a CVSS 3.1 base score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting impact across confidentiality, integrity, and availability. The vulnerability affects Windows 11 versions 23H2, 24H2, and 25H2, along with Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Microsoft published the advisory on December 9, 2025.
Critical Impact
An authorized attacker with low-privileged network access can corrupt heap memory in ReFS and execute code in the context of the file system component, leading to full system compromise.
Affected Products
- Microsoft Windows 11 (23H2, 24H2, 25H2)
- Microsoft Windows Server 2022 and Windows Server 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2025-12-09 - CVE-2025-62456 published to NVD with Microsoft advisory
- 2025-12-12 - Last updated in NVD database
Technical Details for CVE-2025-62456
Vulnerability Analysis
The vulnerability resides in the Windows Resilient File System (ReFS) driver, which provides resiliency, scalability, and integrity features for storage volumes. ReFS parses on-disk metadata structures and handles file system operations exposed to clients across the network through SMB and related services. A heap-based buffer overflow occurs when ReFS processes attacker-influenced data without sufficient bounds checking before writing into a heap-allocated buffer. Successful exploitation overwrites adjacent heap memory, corrupting allocator metadata or function pointers. An authorized attacker with at least low privileges on the target can trigger the condition remotely.
Root Cause
The root cause is improper validation of size or length values used to index into a heap buffer within ReFS metadata or request handling logic. The condition maps to [CWE-122], heap-based buffer overflow. The component writes data past the end of an allocated region because the bounds check is missing, incorrect, or operates on attacker-controlled values.
Attack Vector
The attack vector is Network (AV:N) with low attack complexity and no user interaction. The attacker must hold valid credentials (PR:L) to reach the vulnerable ReFS code paths, typically by accessing a network share or service that exposes ReFS-backed storage. Once the crafted file system operation is issued, the resulting heap corruption can be steered toward arbitrary code execution within the targeted system context. Microsoft documents the issue in the Microsoft Vulnerability Advisory CVE-2025-62456.
No public proof-of-concept exploit is available at this time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.089%.
Detection Methods for CVE-2025-62456
Indicators of Compromise
- Unexpected crashes or bug checks involving ReFS.sys or related storage stack drivers on hosts that mount ReFS volumes.
- Unusual SMB session activity from low-privileged accounts targeting servers that expose ReFS-formatted shares.
- Creation of new services, scheduled tasks, or processes by System shortly after anomalous file system operations.
Detection Strategies
- Monitor Windows Event Logs for ReFS errors, file system driver faults, and Event ID 41 / kernel bug checks tied to storage components.
- Correlate authenticated SMB activity with subsequent process execution from System or service accounts to surface post-exploitation behavior.
- Apply EDR behavioral rules that flag code execution originating from kernel or driver contexts following file system anomalies.
Monitoring Recommendations
- Audit which servers host ReFS volumes and which accounts have network access to those shares.
- Enable verbose SMB and file share auditing on ReFS-backed servers to capture authenticated session metadata.
- Forward driver crash dumps and Windows Error Reporting telemetry to a central SIEM for analysis.
How to Mitigate CVE-2025-62456
Immediate Actions Required
- Apply the December 2025 Microsoft security updates to all affected Windows 11 and Windows Server systems referenced in the advisory.
- Inventory systems hosting ReFS volumes and prioritize patching for those exposing shares over the network.
- Review and reduce the set of accounts that can authenticate to ReFS-backed file servers, enforcing least privilege.
Patch Information
Microsoft has released security updates for Windows 11 23H2, 24H2, and 25H2, and for Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Refer to the Microsoft Vulnerability Advisory CVE-2025-62456 for the specific KB articles and build numbers that contain the fix.
Workarounds
- Restrict network access to ReFS-backed file servers using firewall rules and network segmentation until patches are deployed.
- Disable or restrict SMB access from untrusted networks and require authenticated, signed SMB sessions.
- Where feasible, migrate non-essential workloads off ReFS volumes or limit exposed shares to read-only access for low-privileged users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
