EUVD-2026-29659
GHSA-864v-w6fx-r2g4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and low existing privileges are required (AV:L/PR:L), no user interaction (UI:N), and a kernel-mode compromise yields full SYSTEM control giving total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.
Technical ContextAI
The Common Log File System (CLFS) is a general-purpose transactional logging subsystem implemented in the kernel-mode driver clfs.sys, used by Windows components (TxF/TxR, Kernel Transaction Manager, ETW, and various services) to persist structured log records in Base Log Files (BLFs). The vulnerability is classified as CWE-191 (Integer Underflow / wraparound): a subtraction or size computation over an attacker-influenced field in a crafted log file wraps below zero, producing an unexpectedly large or incorrect length that drives an out-of-bounds memory operation within kernel context. Because clfs.sys runs in the kernel, corrupting its internal state translates directly into arbitrary code execution or memory manipulation at SYSTEM. The CPE set confirms the affected surface is the Microsoft Windows OS itself across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server (2012 through 2025).
RemediationAI
Apply Microsoft's security update for CVE-2026-40397 - the fix is delivered through the standard cumulative/monthly rollup, so install the update that raises the OS to or above the fixed build for your version (for example 10.0.19045.7291 for Windows 10 22H2, 10.0.26100.8457 for Windows 11 24H2, 10.0.20348.5139 for Windows Server 2022, 10.0.26100.32860 for Windows Server 2025), per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40397. Vendor-released patch: apply the cumulative update matching your build. Because CLFS is deeply embedded and disabling clfs.sys is not a supported option, there is no clean feature-level workaround; where immediate patching is impossible, reduce exposure by enforcing least privilege so untrusted or low-trust local accounts cannot run code on the host (this bug requires an existing local foothold), deploy EDR/attack-surface-reduction rules that flag anomalous kernel-driver exploitation, and prioritize multi-user, RDP, and terminal-server systems where low-privileged interactive logons are common. The trade-off of the least-privilege approach is operational friction for shared hosts but no functional loss to CLFS-dependent services.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-191 – Integer Underflow
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today