Windows CLFS Driver CVE-2026-85355

Requires the attacker to already have local, authenticated low-privileged access (PR:L) to the target Windows system - this is a post-foothold privilege-escalation bug, not a remote entry point. Exploitation targets the Common Log File System driver, which is present and loadable in default Windows installations, so no special feature or non-default configuration must be enabled. The principal limiting factor is the high attack complexity (AC:H): success depends on winning a timing/state-dependent condition that is not reliable on every attempt, and no user interaction (UI:N) is involved. Realistic risk is therefore gated on an attacker first achieving local code execution.

This is a local privilege-escalation flaw in the Windows Common Log File System (CLFS) driver (CWE-829, inclusion of functionality from an untrusted control sphere). The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) tells a consistent story: the attacker must already have local code execution with low privileges (PR:L) and must win a non-trivial condition (AC:H, typical of CLFS race/parsing bugs), but on success gains full confidentiality, integrity and availability impact - i.e., SYSTEM-level elevation. Exploitation signals are weak at present: the input provides no EPSS score, no CISA KEV listing, and no POC, so there is no public exploit identified at time of analysis and no evidence of active exploitation. However, CLFS has a strong historical track record as a kernel EoP primitive repeatedly weaponized in ransomware/APT intrusions after patch release, so the medium-term exploitation likelihood is higher than the current absence of signals suggests. Net: this is a credible 'patch promptly' kernel EoP, not a drop-everything remote RCE - the AC:H and PR:L requirements cap the real-world urgency unless paired with an initial-access foothold. Note a data conflict: the 'Information Disclosure' tag contradicts the description, which clearly describes privilege elevation, and the CVSS marks C/I/A all High rather than confidentiality-only.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) runs a crafted program that manipulates CLFS base log (.blf) structures to trigger the vulnerable code path. Winning the required race/parsing condition corrupts kernel state and elevates the attacker to SYSTEM, enabling full host takeover. No public exploit code was identified at the time of analysis, and the high attack complexity (AC:H) means exploitation is not guaranteed on every attempt.