CVE-2022-21959

Deeper analysis

Windows Resilient File System (ReFS) contains a remote code execution vulnerability tracked as CVE-2022-21959. The flaw affects the ReFS component in supported Windows versions and received a CVSS 3.1 score of 6.8 with the vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that successful exploitation can fully compromise confidentiality, integrity, and availability on the target system.

An attacker with physical access to a vulnerable machine can exploit the issue without credentials or user interaction. The attack yields remote code execution, allowing the adversary to run arbitrary code with the privileges of the ReFS process and thereby take complete control of the affected host.

Microsoft published security advisories at the listed references that detail available patches and mitigation guidance. The associated EPSS score remained low after the January 2022 disclosure but later rose materially, reaching a peak of 0.0625 on 2025-01-22 before receding to its current value of 0.0142, indicating renewed exploitation interest well after initial publication.