CVE-2025-27738: Windows Resilient File System (ReFS) Information Disclosure Vulnerability

Overview

Severity
Medium (CVSS 6.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2025-Apr
Released
2025-04-08
Last Updated
2025-04-09
EPSS Score
3.21% (percentile: 87.0%)

Description

Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network.

FAQ

What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability includes unauthorized access to the file system, specifically file path information. Are the updates for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems currently available? Yes. As of April 9, 2025, the security update (5055547) for Windows 10 for x64-based Systems and Windows 10 for 32-bit Systems are available. Customers running Windows 10 should ensure the update is installed to be protected from this vulnerability.

Affected Products (31)

Windows

  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows Server 2022, 23H2 Edition (Server Core installation)
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 11 Version 24H2 for ARM64-based Systems
  • Windows 11 Version 24H2 for x64-based Systems
  • Windows Server 2025
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows Server 2025 (Server Core installation)
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2016
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows Server 2019
  • Windows 10 Version 1809 for x64-based Systems
  • Windows Server 2019 (Server Core installation)

ESU

  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)

Security Updates (10)

Acknowledgments

S&#233;bastien Huneault with <a href="https://cegepoutaouais.qc.ca/">C&#233;gep de l&#39;Outaouais</a>

Revision History

  • 2025-04-08: Information published.
  • 2025-04-09: The security updates for Windows 10 for 32-bit Systems and Windows 10 for x64-based Systems are now available. See the Security Updates table for more information.