What is the CVSS score of EUVD-2026-22493?

EUVD-2026-22493 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by EUVD-2026-22493?

CVE-2026-32070 is a local privilege escalation vulnerability in the Windows Common Log File System driver affecting Windows 10, 11, and Server 2012-2025.. A patch is available.

How to fix or mitigate EUVD-2026-22493?

Within 24 hours: Identify all Windows 10, 11, and Server 2012-2025 systems in your environment using asset inventory tools. Within 7 days: Apply vendor-released patches to all affected systems, prioritizing production servers and systems with high user access. Within 30 days: Complete patching across all remaining Windows systems; validate patch deployment through WSUS or endpoint management tools and verify no exploitation indicators exist in security logs (Event ID 4688 for suspicious local process creation from low-privilege accounts).

Microsoft EUVD-2026-22493

| CVE-2026-32070 HIGH

Use After Free (CWE-416)

2026-04-14 microsoft

Denial Of Service Use After Free Memory Corruption Microsoft

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:31 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22493

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Common Log File System (CLFS) Driver affects Windows 10, 11, and Server 2012-2025 through a use-after-free memory corruption flaw. Authenticated local attackers with low privileges can exploit this vulnerability to gain SYSTEM-level access, achieving full control over confidentiality, integrity, and availability. While no public exploit identified at time of analysis, the Windows CLFS driver has been a frequent target for privilege escalation exploits histor

Technical ContextAI

The Windows Common Log File System (CLFS) is a general-purpose logging subsystem introduced in Windows Server 2003 R2 and Vista, providing high-performance transaction logging services for applications and the kernel. This vulnerability (CWE-416: Use After Free) occurs when the CLFS driver improperly manages memory object lifecycle, allowing a pointer to be dereferenced after the associated memory has been freed. Use-after-free conditions typically arise from race conditions, improper reference counting, or incorrect synchronization in multi-threaded kernel code. The CLFS driver operates at kernel level with SYSTEM privileges, making it a high-value target for privilege escalation. The affected component spans an extensive Windows ecosystem from legacy Windows 10 1607 (build 14393) through current Windows 11 26H1 (build 28000) and Windows Server 2012 through Server 2025, indicating the vulnerability exists in core CLFS code shared across nearly a decade of Windows releases.

RemediationAI

Apply Microsoft's security updates immediately through Windows Update or manual deployment from the Microsoft Update Catalog. Fixed versions include Windows 10 1607 build 10.0.14393.9060 or later, Windows 10 21H2/22H2 build 10.0.19044.7184/10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2012 build 6.2.9200.26026 or later, Windows Server 2012 R2 build 6.3.9600.23132 or later, Windows Server 2016 build 10.0.14393.9060 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. No workarounds are available; patching is the only effective mitigation. Verify successful update installation by checking build numbers in System Properties or using Windows Update history. Full advisory and download links at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32070.