Windows CLFS Driver CVE-2026-40397

Exploitation requires the attacker to already have a valid local, low-privileged account and the ability to execute code on the target host (CVSS PR:L, AV:L) - this is a local privilege-escalation bug, not remotely reachable. The concrete trigger is getting the kernel-mode CLFS driver (clfs.sys) to parse an attacker-crafted Base Log File so the integer underflow in a size/length computation is hit; this is reachable through standard, always-available CLFS logging APIs, so no non-default feature toggle is needed. No user interaction is required (UI:N) and complexity is low (AC:L). Limiting factors: the attacker must first obtain code execution as an authenticated user on the machine, and the affected build must be pre-patch; there is no network-facing exposure, which is why SSVC marks it Automatable=no.

The signals are internally consistent and point to a genuine but not emergency-level priority. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, HIGH) describes a local, low-complexity attack requiring only low existing privileges and no user interaction, with total impact - the classic profile of a post-compromise SYSTEM escalation, not an initial-access vector. Supporting signals reinforce this: SSVC lists Exploitation=none, Automatable=no (local-only, cannot be mass-worm-driven), and Technical Impact=total, while EPSS is very low at 0.06% (19th percentile) and the CVE is not in CISA KEV. No signals conflict. One note of caution: the supplied Tags include 'Information Disclosure' and the intel labels this 'Integer Overflow,' whereas the authoritative description and CWE-191 specify integer underflow enabling privilege elevation - the CVSS C:H/I:H/A:H supports EoP over pure info-disclosure, so treat the tag as loose metadata. Bottom line: not actively exploited and low probability today, but CLFS underflow/overflow bugs have a strong track record of being weaponized for EoP in ransomware intrusions, so this belongs in the normal Patch Tuesday remediation cycle rather than being deprioritized purely on its EPSS score.

An attacker who has already gained a low-privileged foothold on a Windows host - for instance via phishing, a compromised service account, or a standard user login on a shared terminal server - crafts a malicious CLFS base log file and invokes the logging APIs to have clfs.sys parse it. The integer underflow corrupts kernel memory and elevates the attacker to SYSTEM, enabling credential theft, defense evasion, and lateral movement. No public exploit is identified at time of analysis and no user interaction is required.