Windows CLFS Driver CVE-2025-62470
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-priv user code execution on host
-
DeliveryCraft malicious CLFS log-file operation
-
ExploitTrigger heap-based buffer overflow in kernel
-
ExecutionCorrupt adjacent kernel heap structures
-
ImpactEscalate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess local, authenticated access as an authorized (low-privileged) user able to execute code on the target Windows system (PR:L, AV:L) - there is no remote or network exploitation path. No user interaction is needed (UI:N) and complexity is low (AC:L). The vulnerable component, the Common Log File System (CLFS) driver, is present and reachable by default on all affected Windows client and server versions (Windows 10 1607 through Windows 11 25H2, Windows Server 2008 SP2 through Server 2025), so no non-default configuration is required - the limiting factor is solely the prerequisite of an existing local foothold. |
| Impact | All signals converge on a moderate, not urgent, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have code execution as an authorized low-privileged user on the box before this bug is useful - there is no remote or network reach. EPSS is low at 0.51% (41st percentile), it is NOT on the CISA KEV list, and no public exploit code has been identified, so exploitation status is 'no public exploit identified at time of analysis.' These signals are mutually consistent - nothing conflicts here. The one contextual amplifier is history: CLFS (Common Log File System) has been one of the most repeatedly weaponized Windows kernel EOP targets, with multiple prior CLFS bugs graduating to CISA KEV after in-the-wild ransomware/APT use. That elevates watchfulness even though THIS specific CVE currently shows no exploitation. Net: a genuine local EOP-to-SYSTEM primitive in a ubiquitous OS component, but gated behind requiring an existing foothold, and patchable on the normal Patch Tuesday cycle - LOW-to-MEDIUM operational priority absent any KEV/POC change. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host - via phishing payload, a compromised service account, or a chained remote exploit - invokes the vulnerable CLFS driver through crafted log-file operations to trigger the heap-based buffer overflow in kernel memory. By grooming the kernel heap and corrupting adjacent structures, they escalate from a normal user to SYSTEM, achieving full local control. No public proof-of-concept is currently available, but CLFS has a strong track record of exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
A heap-based buffer overflow in the Windows Common Log File System (CLFS) kernel-mode driver lets a local, authenticated attacker with low privileges (CVSS vector PR:L/AV:L) corrupt kernel memory and elevate to higher integrity, including SYSTEM, with no user interaction required (UI:N, AC:L). Every affected Windows build - Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 - ships the vulnerable driver by default, so the only gate is an existing local foothold rather than any non-default configuration. Exploitation is local-only with no network path; EPSS is 0.51% (41st percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV, so the independent assessment rates this as moderate rather than urgent priority.
RemediationAI
Patch status: Patch available per vendor advisory - the single reference (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62470) is the Microsoft Security Response Center update guide, which is where the exact KB numbers and fixed build revisions for each affected edition are published; the input data does not contain an exact fix version or KB identifier, so confirm and apply the applicable cumulative security update for every affected Windows 10, Windows 11, Windows Server 2008 SP2 through Server 2025 build rather than assuming a generic build number. Until patching is complete, note that there is no feature toggle or configuration that removes CLFS - it is a core logging subsystem reachable by ordinary local processes - so mitigations must reduce the likelihood of the prerequisite local foothold rather than the vulnerable code path itself: enforce least privilege so that interactive and service accounts cannot execute arbitrary code on sensitive hosts (trade-off: it degrades legitimate administrative workflows that rely on local tooling); apply WDAC or AppLocker to restrict which binaries can run on servers and privileged workstations (trade-off: allow-listing requires ongoing maintenance and can block unsanctioned line-of-business software); segment and monitor so that suspicious creation of .blf/container log files in user-writable or non-standard paths, unexpected CLFS API use by low-integrity processes, and kernel pool corruption telemetry are alerted on (trade-off: noisy, needs tuning but is the main detective control for a local overflow); and reduce the value of a successful elevation by tiering administrative accounts and using Credential Guard/LSA protection so a SYSTEM-level compromise on one host does not yield domain-wide credentials (trade-off: additional management overhead and some legacy application incompatibility). Because exploitation requires an existing local authenticated session, prioritizing remote attack surfaces is reasonable, but all affected builds should still be patched within a normal monthly cycle given the CVSS 7.8 severity and the fact that successful exploitation yields full SYSTEM control.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CLFS is a general-purpose, kernel-mode logging subsystem that Windows and third-party applications use to write transactional log streams in base log files (.blf) and container files; the driver is loaded by default and exposed to unprivileged callers through the CLFS user-mode APIs. The assigned weakness is CWE-122 (heap-based buffer overflow), meaning the driver mishandles a length or size calculation for heap-allocated (kernel pool) memory and writes beyond the end of the allocation. In kernel mode that memory corruption is directly security-relevant: a controlled overflow can overwrite adjacent pool metadata or kernel objects, which is the classic pathway from a low-integrity local process to arbitrary kernel read/write and full privilege elevation to SYSTEM. Because the flaw is in a logging driver rather than a specific application, the attack surface is broad across the affected operating system family while remaining strictly local - the CPE entries confirm coverage of the full supported Windows client line (10 1607/1809/21H2/22H2, 11 23H2/24H2/25H2) and the server line (Server 2008 SP2 through Server 2025), and the CVSS scope is Unchanged with High confidentiality, integrity and availability impact once code execution at kernel level is achieved. All data points are consistent with the independent assessment: the limiting prerequisite is a pre-existing local, authenticated foothold (PR:L), not technical difficulty or configuration.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel EOP requiring an existing low-privileged foothold (AV:L, PR:L), no user interaction, yielding full SYSTEM compromise (C:H/I:H/A:H); agrees with Microsoft's vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity vulnerability in the Windows Common Log File System kernel-mode driver affects all Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025 builds, allowing an authenticated local attacker with low privileges to elevate to SYSTEM. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but a local foothold is the only prerequisite, so any compromised endpoint or server user account can become a full system compromise. Leadership should prioritize compensating controls and detection because successful exploitation could enable credential theft, lateral movement, and ransomware deployment across the Windows estate.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing least privilege and removing unnecessary local admin rights, restricting interactive logon, applying application allowlisting, deploying EDR/behavioral detection for CLFS abuse, and auditing local accounts. Apply vendor patch once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)CVE.org
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
GitHub PoC
Exploit-DB