What is the CVSS score of CVE-2023-36424?

CVE-2023-36424 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 10.3%.

Is there a public PoC exploit available for CVE-2023-36424?

Yes, a public proof-of-concept exploit is available for CVE-2023-36424. Prioritise patching immediately. EPSS: 10.3%.

How to fix or mitigate CVE-2023-36424?

Within 24 hours: Identify and catalog all Windows 10 (versions 1507 through 22H2) and Windows 11 21H2 systems in your environment. Within 7 days: Deploy Microsoft's monthly Patch Tuesday security updates containing CVE-2023-36424 fixes to all affected systems via WSUS or equivalent patch management tool. Within 30 days: Verify 100% patch compliance across the environment and implement detection rules in your EDR/SIEM platforms for exploitation attempts targeting the CLFS driver.

Windows CLFS Driver CVE-2023-36424

HIGH

Out-of-bounds Read (CWE-125)

2023-11-14 secure@microsoft.com

Buffer Overflow Information Disclosure Microsoft

7.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain low-priv local execution
Delivery

Drop CLFS exploit binary
Exploit

Craft malicious CLFS log file
Install

Trigger OOB read in clfs.sys
C2

Corrupt kernel memory to SYSTEM token
Execute

Disable defenses and persist
Impact

Lateral movement and ransomware deployment

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Attacker must already have local code execution on the host as any authenticated low-privileged user (CVSS PR:L, AV:L); no user interaction is required (UI:N) and no special Windows feature or non-default configuration must be enabled because the CLFS driver is loaded by default on every supported Windows 10 (1507-22H2) and Windows 11 21H2 install. Exploitation is limited to local scenarios - it cannot be triggered remotely over the network without a prior foothold - and requires the target host to be unpatched against the November 2023 Microsoft update; fully patched systems and hosts where the user cannot execute arbitrary binaries (strict application allowlisting) are not exploitable.
Impact	The CVSS vector (AV:L/AC:L/PR:L/UI:N) describes a low-complexity local attack requiring only low privileges, with high confidentiality, integrity, and availability impact - a classic SYSTEM-level EoP profile. The 10.30% EPSS (93rd percentile) is unusually high for a local-only bug and is corroborated by the CISA KEV listing and confirmed public exploit code, so this is not a theoretical high-CVSS issue but a real, prioritized post-compromise tool already in adversary playbooks (CLFS bugs have been repeatedly weaponized by ransomware operators). One note of friction: the NVD tags include 'Information Disclosure' while the CWE is out-of-bounds read and the CVSS shows C:H/I:H/A:H - the I:H/A:H ratings suggest the OOB read is being leveraged into a fuller memory-corruption primitive for code execution, which is consistent with how prior CLFS bugs have been chained, but defenders should treat this as EoP-to-SYSTEM rather than pure infoleak.
Exploit ScenarioDerived	An attacker who has already obtained low-privileged code execution on a Windows endpoint - for example via a phishing-delivered loader or a compromised user session - runs a public CLFS exploit binary that crafts a malicious log file to trigger the out-of-bounds read in clfs.sys, corrupting kernel memory and elevating the process to NT AUTHORITY\SYSTEM. With SYSTEM privileges the attacker disables endpoint protection, dumps LSASS for credentials, and pivots laterally; public exploit code for this CVE is available, lowering the skill required.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 10.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Local privilege escalation in the Windows Common Log File System (CLFS) driver allows authenticated low-privileged attackers to elevate to SYSTEM on Windows 10 (1507 through 22H2) and Windows 11 21H2. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and EPSS places it in the 93rd percentile for exploitation likelihood. Microsoft has released patches via standard monthly updates.

RemediationAI

Apply the Microsoft security update for CVE-2023-36424 from the November 2023 Patch Tuesday cycle (vendor-released patch available) by installing the appropriate cumulative update for each affected Windows 10 servicing branch (1507/1607/1809/21H2/22H2) and Windows 11 21H2, consulting Microsoft's MSRC advisory for the exact KB number per build. Because the vulnerability is in clfs.sys and reachable from any local user, there is no clean configuration workaround; compensating controls until patching is complete include enforcing least-privilege so that initial-access malware lands as a constrained user (to slow but not prevent the EoP), enabling Microsoft Defender / EDR rules targeting known public CLFS exploit primitives, and using attack surface reduction rules and application allowlisting to limit which binaries can run and thereby invoke the vulnerable driver - none of these block the bug itself, only narrow the population of attackers who can reach it.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Common Log File System (clfs.sys) is a kernel-mode driver shipped with Windows that provides a general-purpose transactional logging facility used by services, the kernel transaction manager, and applications. The CWE-125 (out-of-bounds read) classification, combined with the 'Buffer Overflow' tag, indicates the driver reads past the bounds of an allocated buffer when parsing attacker-supplied CLFS log file structures (.BLF files or related log containers), which has historically been a fruitful target for kernel EoP because CLFS log parsing is reachable from user mode and runs in ring 0. The CPE list confirms every supported Windows 10 servicing branch (1507/1607/1809/21H2/22H2) on x86, x64, and ARM64, plus Windows 11 21H2 are affected, indicating a long-standing defect in the shared CLFS code path.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Apr 13, 2026 - 18:57 CISA

DescriptionCVE.org

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Executive ViewAI

Why It Matters

A local privilege escalation vulnerability in the Windows CLFS driver enables authenticated low-privileged users to escalate to SYSTEM level, granting complete system control. This vulnerability is confirmed actively exploited (CISA KEV) across Windows 10 and Windows 11 systems globally. Organizations must treat this as a critical patching priority to prevent compromised endpoints from becoming stepping stones for lateral movement and data access.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score

4.9/10

Composite threat intelligence

EPSS Score

10.3%

Top 7% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

CISA KEV

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV Yes

Public POC Yes

EPSS 10.3%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Small

Automatable· derived

Human Impact

Very High

Priority Score

119

Low Medium High Critical

KEV: +50

EPSS: +10

CVSS: +39

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.