Windows EUVD-2025-17791

CVSS 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates moderate-to-high severity: (1) Attack Vector LOCAL only—requires system access, reducing widespread internet-based attack surface; (2) Attack Complexity LOW—the overflow is straightforward to trigger without special conditions; (3) Privileges Required LOW—any authenticated local user can trigger (includes guest/limited accounts); (4) No User Interaction—automatic exploitation possible; (5) Impact CRITICAL—all three security pillars compromised (confidentiality, integrity, availability). The real-world risk is substantial because: local privilege escalation is a fundamental post-compromise objective for attackers, CLFS driver is present on all Windows systems, and low AC means rapid exploitation once details emerge. If EPSS data were available, expected probability would be HIGH (>0.8) given the low complexity and local-only requirement. Without confirmed KEV or active exploitation evidence, classify as HIGH PRIORITY but not yet CRITICAL; this is a strong candidate for rapid weaponization post-patch release.

An attacker with local user access (obtained via phishing, supply chain, or insider threat) executes a crafted application that repeatedly calls CLFS IOCTLs with oversized log record structures. The malicious payload carefully positions heap memory to corrupt function pointers or virtual method tables. Upon triggering the overflow, the attacker's shellcode executes in kernel context, installing a rootkit or adding an admin account. Example attack chain: (1) Attacker logs in as standard user, (2) Launches exploit binary from temporary directory, (3) Exploit sends specially-crafted CLFS_WRITE_LOG IOCTL with buffer size exceeding internal heap allocation, (4) Heap corruption grants kernel code execution, (5) Attacker creates SYSTEM-level account or launches reverse shell. No public POC currently confirmed, but the simplicity of heap overflow exploitation and detailed CVE description suggest POC development is imminent. Average time-to-exploit post-disclosure is typically 7-14 days for local privilege escalation vulnerabilities with low complexity.