Windows CLFS CVE-2026-85868

Requires the attacker to already possess valid low-privileged local credentials/code execution on the target Windows host (PR:L, AV:L) - this is a post-compromise privilege escalation, not a remote entry point. The vulnerable Common Log File System driver is present by default in every supported Windows build, so no special feature or non-default configuration is needed to reach the code. Exploitation is limited by high attack complexity (AC:H): the use-after-free is a race condition requiring the attacker to reliably win a timing window, which reduces real-world reliability and makes weaponization harder. No user interaction is required (UI:N).

This is a moderate-priority local privilege escalation in the Windows Common Log File System (CLFS) driver (CVE-2026-85868), a historically heavily-targeted kernel component. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a vulnerability requiring local access, an already-authenticated low-privileged account, and high attack complexity - consistent with a use-after-free race condition rather than a trivial one-shot exploit. Technical impact is total (C:H/I:H/A:H, SSVC 'total'), meaning successful exploitation yields full SYSTEM-level control. However, the exploitation signals are currently low: CISA SSVC lists Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, no public POC is referenced, and no EPSS score was provided. The signals are internally consistent (no conflict between CVSS and description - both point to local EoP). The main caveat is historical: CLFS has been the subject of multiple previously weaponized zero-days, so this class of bug is attractive to attackers and the 'Exploitation: none' status could change. At time of analysis this is a patch-in-normal-cycle item, not an emergency, but it should be prioritized above typical high-complexity local flaws because of the affected component's exploitation track record.

An attacker who already has a foothold as a low-privileged local user (for example via phishing, a compromised service account, or a prior low-impact bug) triggers the use-after-free in the CLFS driver by manipulating log file operations to win a timing race, corrupting kernel memory to execute code as SYSTEM. The high attack complexity (AC:H) means the attacker must reliably exploit a race window, so exploitation is non-trivial; no public exploit code was identified at time of analysis.