Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2026-50501 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Microsoft Windows 11 24H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-16 (Memory Protection) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-44109
Vulnerability Data
Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in ReFS driver enables local code execution, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Memory protection mechanisms (e.g., stack canaries, ASLR, DEP) directly block exploitation of the stack-based buffer overflow in ReFS.
Disabling or restricting the ReFS driver when not required eliminates the vulnerable attack surface for local code execution.
Least-privilege restrictions on local users and processes limit the ability of an unauthorized attacker to trigger the ReFS flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly prevent introduction of stack buffer overflows.
Vulnerability scanning can discover stack buffer overflows but does not prevent their introduction.
Patching eliminates known instances of the weakness after discovery.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing (fuzzing, static analysis) detects stack overflows before release.
Secure SDLC mandates buffer-safety practices that directly prevent stack overflows.
Application security requirements can specify buffer-size and input-validation rules.
Secure architecture principles include memory-safety and least-privilege stack usage.
Secure coding standards explicitly forbid unsafe buffer handling that causes CWE-121.
Change-management gates can enforce security reviews that catch buffer issues.