cve 2026 54109

The cve 2026 54109 tag covers Microsoft’s July 14, 2026 security update for an integer-overflow vulnerability in the Windows Resilient File System (ReFS). The flaw can allow an authorized attacker to execute code locally on affected Windows clients and servers through crafted storage input. Microsoft rates the issue Important and assigns it a CVSS 3.1 score of 7.8. Although the vulnerability is described under a Remote Code Execution category, the available technical details characterize it as a local storage-input threat rather than a remotely reachable network service flaw. Microsoft reported no public disclosure or active exploitation when the update was released.