Windows CLFS Driver CVE-2026-83835

Exploitation requires the attacker to already have local, authenticated low-privileged access to the Windows host (CVSS PR:L, AV:L) with the ability to run code that interacts with the Common Log File System (CLFS) kernel driver - a component present by default on all supported Windows editions, so no special feature toggle or non-default configuration is needed. The key LIMITING factors are: no remote attack surface (local access mandatory), prior authentication/foothold required, and the impact is confined to information disclosure (C:H, I:N, A:N) rather than code execution or system compromise. No user interaction is required (UI:N). Affected systems are those running CLFS driver builds below the patched versions listed in EUVD-2026-100009 (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650).

This is a moderate-severity local information-disclosure flaw that signals a low real-world priority despite being a kernel-driver bug. All signals align toward low urgency: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) requires local access and existing low-level privileges, meaning an attacker must already have authenticated code-execution on the host; CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. There is no CISA KEV listing and no public exploit identified, so this is not confirmed actively exploited. The CWE-126 buffer over-read and C:H/I:N/A:N impact profile mean the realistic payoff is disclosure of adjacent kernel memory (potentially sensitive pointers or secrets) with no integrity or availability loss - most valuable as a secondary primitive to defeat KASLR or chain with a privilege-escalation bug rather than as a standalone threat. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. Note a minor label tension: the input Tags say 'Buffer Overflow' but the description and CWE-126 both specify a buffer over-READ (a read-only disclosure, not a memory-corruption overflow) - treat it as an info-leak, not a write primitive.

An attacker who has already gained low-privileged authenticated code execution on a Windows host (e.g., via a malicious local process or a foothold from another vulnerability) invokes a crafted operation against the Common Log File System driver that triggers an out-of-bounds read, returning adjacent kernel memory contents. The leaked data (such as kernel addresses or secrets) is then used to bypass memory-protection mitigations and strengthen a separate privilege-escalation chain. No public exploit code has been identified at time of analysis, and the local-only, low-complexity vector means exploitation is straightforward for an attacker already present on the system.