Windows CLFS Driver CVE-2026-62728

Exploitation requires an authenticated local session with at least low-privilege (standard user) rights on the target Windows system - the CVSS vector PR:L confirms this. The attacker must be able to execute code locally to trigger the race condition in the CLFS kernel driver; remote unauthenticated exploitation is not supported by the local attack vector (AV:L). Winning the TOCTOU race requires AC:H, meaning the attacker must time concurrent operations precisely, which adds non-trivial technical complexity and reduces reliability compared to deterministic exploits. No special Windows feature or non-default configuration is cited as a prerequisite - the CLFS driver is loaded by default on all affected Windows versions. Exploitation is limited to local sessions: remote attackers would first need to obtain code execution or an interactive session on the target (e.g., via RDP, a web shell, or another initial-access vulnerability) before this flaw becomes relevant.

The CVSS 7.0 score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local, low-privilege attacker who must win a race condition - a non-trivial technical bar (AC:H). Despite the complexity, CLFS LPE vulnerabilities have a strong historical precedent for real-world weaponization: CVE-2022-24521 and CVE-2023-28252 (both CLFS LPEs) were confirmed in CISA KEV and used by ransomware operators, which means the CLFS attack surface is actively researched by threat actors. No EPSS data was provided in the input, and this CVE is not currently in CISA KEV, so exploitation status is unconfirmed. The absence of a KEV listing should not breed complacency - even a mid-sized municipal IT team in gniezno should treat a CLFS LPE patch as urgent given the class's exploitation history. The breadth of affected platforms (Server 2012 through Windows 11 26H1, covering 19 distinct version-build combinations) substantially expands the attack surface in any mixed Windows environment. The CWE-125/TOCTOU discrepancy (see confidence_notes) does not materially change the risk posture: both paths enable memory corruption leading to privilege escalation.

An attacker with a low-privileged local user account (e.g., obtained via phishing or lateral movement) launches a multi-threaded process that repeatedly triggers CLFS log operations, racing to corrupt a kernel structure during the check-to-use window in clfs.sys. Successfully winning the race allows the attacker to overwrite a security-sensitive kernel object, escalating to SYSTEM and gaining full control of the host. No public proof-of-concept exploit code has been identified at time of analysis, but the CLFS attack surface is well-understood by advanced threat actors.