Windows CLFS Driver CVE-2026-70233

Exploitation requires the attacker to already have local, low-privileged authenticated code execution on the target Windows system (PR:L, AV:L) - it is not remotely reachable and cannot be triggered across the network or by luring a user to content. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold exists, exploitation is straightforward against default configurations because the CLFS driver is present and enabled by default on all supported Windows editions. The primary limiting factor is the need for a prior initial-access/code-execution capability on the host; there is no special non-default feature or configuration prerequisite called out in the description.

This is a credible, high-priority patching target despite not being a maximum-severity remote flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation issue requiring low-privilege authenticated access with low attack complexity and no user interaction, yielding full confidentiality, integrity, and availability impact on the local system. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation - this tempers immediate urgency. However, the Windows Common Log File System (CLFS) driver has a well-established historical pattern of heap-overflow EoP bugs being weaponized as the second stage of ransomware and post-compromise intrusions, so real-world risk is higher than the absence of EPSS/KEV signals alone would suggest. The signals are internally consistent (local vector matches an EoP description), with no contradictions to flag; the main missing data is exploitation telemetry (EPSS/KEV/POC all absent from input), which should be treated as unknown rather than low.

An attacker who has already gained a low-privileged foothold on a Windows host - via phishing, a web exploit, or stolen credentials - runs a crafted program that abuses the CLFS driver, triggering a heap-based buffer overflow in kernel memory to escalate to SYSTEM. With low attack complexity and no user interaction required, this is a reliable local post-exploitation step. No public exploit was identified in the provided data, but CLFS EoP flaws are historically turned into working exploits quickly.