CVE-2023-32008 - Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

HIGH

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Published Jun 13, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.72%

Windows Resilient File System (ReFS) Remote Code Execution Vulnerability

Vendor Microsoft Product Windows 10 Version 1507 Default
unknown
Affected
- ≥ 10.0.10240.0, < 10.0.10240.19983
Vendor Microsoft Product Windows 10 Version 1607 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.5989
Vendor Microsoft Product Windows 10 Version 1809 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.17763.4499
- ≥ 10.0.17763.0, < 10.0.17763.4499
Vendor Microsoft Product Windows 10 Version 21H2 Default
unknown
Affected
- ≥ 10.0.19043.0, < 10.0.19044.3086
Vendor Microsoft Product Windows 10 Version 22H2 Default
unknown
Affected
- ≥ 10.0.19045.0, < 10.0.19045.3086
Vendor Microsoft Product Windows 11 version 21H2 Default
unknown
Affected
- ≥ 10.0.0, < 10.0.22000.2057
Vendor Microsoft Product Windows 11 version 22H2 Default
unknown
Affected
- ≥ 10.0.22621.0, < 10.0.22621.1848
Vendor Microsoft Product Windows Server 2016 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.5989
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.5989
Vendor Microsoft Product Windows Server 2019 Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.4499
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.4499
Vendor Microsoft Product Windows Server 2022 Default
unknown
Affected
- ≥ 10.0.20348.0, < 10.0.20348.1787

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 10 Version 1507	unknown	Affected ≥ 10.0.10240.0, < 10.0.10240.19983
Microsoft	Windows 10 Version 1607	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.5989
Microsoft	Windows 10 Version 1809	unknown	Affected ≥ 10.0.0, < 10.0.17763.4499 ≥ 10.0.17763.0, < 10.0.17763.4499
Microsoft	Windows 10 Version 21H2	unknown	Affected ≥ 10.0.19043.0, < 10.0.19044.3086
Microsoft	Windows 10 Version 22H2	unknown	Affected ≥ 10.0.19045.0, < 10.0.19045.3086
Microsoft	Windows 11 version 21H2	unknown	Affected ≥ 10.0.0, < 10.0.22000.2057
Microsoft	Windows 11 version 22H2	unknown	Affected ≥ 10.0.22621.0, < 10.0.22621.1848
Microsoft	Windows Server 2016	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.5989
Microsoft	Windows Server 2016 (Server Core installation)	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.5989
Microsoft	Windows Server 2019	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.4499
Microsoft	Windows Server 2019 (Server Core installation)	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.4499
Microsoft	Windows Server 2022	unknown	Affected ≥ 10.0.20348.0, < 10.0.20348.1787

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-36295		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32008		vendor-advisoryPatchVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Jun 13, 2023

Updated Jan 1, 2025

Reserved May 1, 2023

CISA Vulnrichment

Updated May 29, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Jun 13, 2023

Updated Jan 1, 2025

GitHub

No data