EUVD-2026-35743
GHSA-mwwp-2qj3-893w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Common Log File System (CLFS) Driver allows an authenticated low-privileged attacker to elevate to SYSTEM via a use-after-free memory corruption flaw. The vulnerability carries a CVSS 7.8 rating with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. CLFS has a long history of being targeted for kernel-level privilege escalation, making this class of bug a recurring concern for Windows defenders.
Technical ContextAI
The Common Log File System (CLFS) is a general-purpose logging subsystem implemented in the kernel-mode driver clfs.sys, used by Windows applications and services for high-performance transaction logging. The root cause is CWE-416 (Use After Free), in which the driver references memory after it has been freed, allowing an attacker who can control the reallocated contents to corrupt kernel structures. Because clfs.sys runs in kernel space and is reachable from low-integrity user contexts via documented APIs, a successful UAF exploit typically yields arbitrary kernel read/write and full SYSTEM-level code execution.
RemediationAI
Apply the Microsoft monthly cumulative security update that addresses CVE-2026-44809 across all Windows endpoints and servers as listed on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44809; exact KB article and build numbers should be taken directly from that MSRC entry since they were not included in the provided intelligence. Until patches are deployed, reduce blast radius by enforcing least privilege so standard users cannot run untrusted binaries, enabling Microsoft Defender attack surface reduction rules that block abuse of vulnerable signed drivers, and monitoring EDR for anomalous process token elevation and child processes of services that use CLFS - note that CLFS cannot simply be disabled because it is used by core OS components including the kernel transaction manager, so removal or driver blocklisting is not a viable workaround.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today