CVE-2022-21958

Deeper analysis

Windows Resilient File System (ReFS) contains a remote code execution vulnerability tracked as CVE-2022-21958. The flaw affects the ReFS driver in supported Windows versions and carries a CVSS 3.1 score of 6.8 with an attack vector requiring physical access, low complexity, no privileges, and no user interaction, resulting in high impact to confidentiality, integrity, and availability.

An attacker with physical access to a system using ReFS-formatted volumes can exploit the vulnerability to execute arbitrary code. Successful exploitation grants the attacker the ability to compromise the confidentiality, integrity, and availability of the affected system without needing credentials or user interaction.

Microsoft has published security guidance and updates addressing the issue through its standard advisory channels. The associated EPSS score remained low after initial disclosure but rose materially to a peak of 0.0625 in January 2025 before receding, indicating a later surge in exploitation interest that warrants renewed attention.