Windows CLFS Driver CVE-2026-50697

The attacker must already be an authenticated, low-privileged local user on the target Windows machine (CVSS PR:L, AV:L) with the ability to run code and invoke the CLFS driver - remote or unauthenticated exploitation is not possible with this vulnerability alone. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access is obtained escalation is reliable and does not depend on a special or non-default configuration; the CLFS driver is present and loaded by default on every affected Windows client and server release. The principal limiting factor is therefore the prerequisite local foothold: this bug is a second-stage privilege-escalation primitive, not an initial-access vector.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, low existing privileges required, no user interaction, and high impact to confidentiality, integrity, and availability - a textbook local elevation-of-privilege profile rather than a remote or worm-able flaw. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so exploitation likelihood cannot be quantified from the input and should be treated as no public exploit identified at time of analysis. Note a signal tension worth flagging: the description and CWE-200 frame this as pure information disclosure, yet the vector asserts full C:H/I:H/A:H integrity and availability impact - this is consistent with Microsoft rating the ultimate elevation-of-privilege outcome rather than the initial leak, but the raw leak primitive alone would normally be C:H/I:N/A:N, so treat the I/A impact as the chained EoP result. Given CLFS's long history as a favored local-EoP and ransomware post-compromise target, this should be prioritized for patching on all Windows endpoints even absent confirmed exploitation.

An attacker who has already achieved low-privileged code execution on a Windows host - for example through phishing, a compromised service account, or a foothold on a shared terminal server - invokes the CLFS driver with crafted log-file operations to leak sensitive kernel memory and chain it into arbitrary kernel-level control, elevating to SYSTEM. Given AV:L/AC:L, exploitation is fully local with low complexity and needs no user interaction. No public proof-of-concept was identified in the provided data, but CLFS elevation bugs are a well-established post-compromise technique.