CVE Vulnerability Advisory Database

[Affected Scope] Microsoft Windows 10, 11, and Windows Server operating systems utilizing the Common Log File System (CLFS) driver

[Impact] An authorized local attacker can exploit this vulnerability to elevate privileges to SYSTEM level and gain full control of the host

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor for anomalous CLFS log file activities

[Affected Scope] All supported versions of Microsoft Windows and Windows Server utilizing the Common Log File System (CLFS) driver.

[Impact] An authorized local attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete host compromise.

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and restrict unauthorized local interactive access.

[Affected Scope] Windows 10, Windows 11, and Windows Server operating systems utilizing the Common Log File System (CLFS.sys) driver.

[Impact] An authorized local attacker can execute arbitrary code in kernel mode and elevate privileges to NT AUTHORITY\SYSTEM.

[Mitigation] Immediately apply the latest cumulative security updates released by Microsoft (March 2025 Patch Tuesday or later).

[Affected Scope] Windows 10, 11, and Windows Server systems utilizing the Common Log File System (CLFS) driver

[Impact] Local attackers can exploit this vulnerability to execute arbitrary code in kernel mode, escalating privileges to SYSTEM

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict unauthorized creation of CLFS log (.blf) files

[Affected Scope] Microsoft Windows operating systems utilizing the CLFS driver, including Windows 10, 11, and Windows Server 2016, 2019, 2022

[Impact] A locally authenticated attacker can execute a specially crafted application to elevate privileges to NT AUTHORITY\SYSTEM, gaining full control over the system

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft and monitor unpatched assets

[Affected Scope] Windows 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022 utilizing the clfs.sys driver

[Impact] Local attackers can execute arbitrary code with SYSTEM privileges, fully compromising the host and disabling security controls

[Mitigation] Apply the Microsoft April 2023 security updates immediately, or restrict .blf file creation permissions as a temporary workaround

[Affected Scope] Microsoft Windows operating systems including Windows 10, 11, and Windows Server 2016, 2019, 2022 utilizing the CLFS driver

[Impact] A local attacker with low privileges can execute arbitrary code in kernel mode, leading to complete system takeover with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft cumulative security updates (February 2023 Patch Tuesday) and monitor unpatched assets

[Affected Scope] Almost all active versions of Windows OS, including Windows 7, 8.1, 10, 11, and Windows Server 2008 through 2022.

[Impact] A local attacker can exploit this vulnerability to gain SYSTEM privileges, leading to complete compromise of the target system.

[Mitigation] Immediately apply the September 2022 Microsoft security updates and monitor unpatched assets for anomalous local execution.

[Affected Scope] All Windows systems utilizing the Common Log File System (CLFS.sys) driver, including Windows 10, 11, and Windows Server editions.

[Impact] A local attacker can execute arbitrary code in kernel mode via a specially crafted application, leading to complete SYSTEM privilege escalation.

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and monitor for unauthorized local process executions and anomalous CLFS log creations.