CVE-2026-23673
Published: 10 March 2026
Summary
CVE-2026-23673 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-23673 is an out-of-bounds read vulnerability, classified under CWE-125, affecting the Windows Resilient File System (ReFS). Published on 2026-03-10, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite requiring local access.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity and no user interaction. Successful exploitation enables privilege escalation, granting high-level access that compromises confidentiality, integrity, and availability of the affected system.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23673.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10596
Vulnerability details
Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local out-of-bounds read in ReFS directly enables privilege escalation from low-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the out-of-bounds read vulnerability in ReFS by requiring timely remediation through vendor patches as specified in the Microsoft advisory.
Implements memory protection mechanisms such as address space layout randomization and stack guards that mitigate exploitation of out-of-bounds reads in the file system.
Enforces least privilege to limit the impact of local low-privilege attackers attempting privilege escalation via the ReFS vulnerability.