# CVE-2026-40407 — Windows CLFS `clfs.sys` Heap-Based Buffer Overflow in ReadLogBlock
---
## Summary
| **Product** | Microsoft Windows — `clfs.sys` (Common Log File System kernel driver) |
|-----------------------|-----------------------------------------------------------------------|
| **Vendor** | Microsoft Corporation |
| **Severity** | High |
| **Affected Versions** | Windows 10 (all versions); Windows 11 (21H2–24H2); Windows Server 2016–2025 |
| **Impact** | Elevation of Privilege — Local user to SYSTEM |
| **CVE ID** | CVE-2026-40407 |
| **CWE** | CWE-122: Heap-based Buffer Overflow |
| **Patch Available** | Yes |
| **Patch Date** | May 2026 — KB5089549 (primary fix); July 2026 — KB5101650 (hardening) |
---
## CVSS 4.0 Detailed Scoring
**Base Score:** 8.5 (HIGH)
**Vector String:** `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
| **Metric** | **Value** | **Rationale** |
|---|---|---|
| **Attack Vector (AV)** | Local | Requires local authenticated session |
| **Attack Complexity (AC)** | Low | BLF file format is documented; crafting an out-of-range LSN is straightforward |
| **Attack Requirements (AT)** | None | CLFS is always present in all Windows installations |
| **Privileges Required (PR)** | Low | Standard user account; no administrative rights required |
| **User Interaction (UI)** | None | No interaction from any other user required |
| **Vulnerable System Confidentiality (VC)** | High | Heap overflow enables arbitrary kernel R/W |
| **Vulnerable System Integrity (VI)** | High | Pool corruption enables token swap to SYSTEM |
| **Vulnerable System Availability (VA)** | High | Heap corruption causes BSOD |
| **Subsequent System Confidentiality (SC)** | High | SYSTEM access enables credential harvesting |
| **Subsequent System Integrity (SI)** | High | SYSTEM access enables persistence |
| **Subsequent System Availability (SA)** | High | Full system compromise |
---
## Product Description
`clfs.sys` is the kernel driver implementing the Common Log File System (CLFS), a general-purpose high-performance logging subsystem. CLFS operates on Base Log Files (`.blf`) containing control records, metadata blocks, and container descriptors. The `ReadLogBlock` function reads log data blocks from containers by resolving Log Sequence Numbers (LSNs) to physical file offsets, then copying block data into kernel buffers via `CcCopyRead`.
CLFS has been a persistent source of kernel EoP vulnerabilities due to the trust placed in file-sourced metadata — LSN values from BLF files are used directly to compute buffer offsets without sufficient validation.
---
## Vulnerability Summary
`CClfsLogFcbPhysical::ReadLogBlock` resolves a caller-supplied LSN to locate and read a log data block. After obtaining the next owner-page LSN via `GetNextOwnerPageLsn`, the function proceeds into a `CcCopyRead`/`memset` block-copy loop that reads data from the log container into a kernel buffer. Pre-patch, there is no bounds check comparing the caller-supplied LSN (`param_2`) against the resolved owner-page boundary — an out-of-range LSN can drive the copy loop past the buffer's validated extent, overflowing the heap allocation.
An attacker who controls the BLF metadata can craft an LSN that passes initial validation but exceeds the owner-page boundary, causing `CcCopyRead` to write beyond the allocated read buffer into adjacent pool memory. This enables classic pool corruption → token swap exploitation for SYSTEM elevation.
---
## Prerequisites and Constraints
- Local authenticated session (standard user; no administrative rights required)
- CLFS is always present — it is a core Windows kernel component
- BLF files can be created in any user-writable directory via `CreateLogFile` API
- The vulnerability is reachable via normal log read operations after opening a crafted BLF
- No special hardware, kernel driver, or pre-existing SYSTEM token required
- Pool spray via named pipes provides deterministic heap layout control
---
## Vulnerability Details
### Vulnerable Code Path
```
User mode:
CreateLogFile() → creates/opens BLF
AddLogContainer() → adds container
ReserveAndAppendLog() → writes records
[close handle]
[patch BLF on disk] → inject out-of-range LSN in owner-page metadata
CreateLogFile() → reopen corrupted BLF
ReadLogFile() → triggers ReadLogBlock with crafted LSN
Kernel mode:
CClfsRequest::Dispatch()
→ CClfsLogFcbPhysical::ReadLog()
→ CClfsLogFcbPhysical::ReadLogBlock()
→ GetNextOwnerPageLsn() // resolves owner-page boundary
→ Feature_748929339 check // *** MISSING PRE-PATCH ***
→ CcCopyRead/memset loop // *** HEAP OVERFLOW ***
```
### The Overflow
In the pre-patch binary, `ReadLogBlock` at address `0x140002470`:
1. Calls `GetNextOwnerPageLsn(this, &local_c0, param_2)` to resolve the next owner page
2. Stores the result in `local_f8` / `lVar17`
3. Falls directly through into the `CcCopyRead`/`memset` block-copy loop
The block-copy loop uses the LSN to compute offsets into the read buffer. When the LSN exceeds the owner-page boundary, the computed offset exceeds the buffer allocation, and `CcCopyRead` writes past the buffer end into adjacent pool memory.
### The Fix (KB5089549, May 2026)
The patch inserts a `Feature_748929339`-gated bounds check between steps 2 and 3:
```c
plVar11 = (longlong *)GetNextOwnerPageLsn(this, &local_c0, param_2);
lVar17 = *plVar11;
local_f8 = lVar17;
// >>> PATCH: bounds check added here <<<
uVar12 = Feature_748929339__private_IsEnabledDeviceUsageNoInline();
if ((int)uVar12 != 0) {
if (param_2 == NULL) {
bVar1 = false;
if (bVar1) goto LAB_3; // proceed to copy
}
else if ((*(uint *)(param_2 + 4) <= local_f8._4_4_) &&
((local_f8._4_4_ != *(uint *)(param_2 + 4) ||
(*(uint *)param_2 < (uint)lVar17)))) {
bVar1 = true;
goto LAB_2; // proceed to copy
}
// >>> bail out — LSN exceeds owner-page boundary <<<
pIVar20 = (IClfsRequestAsync *)&DAT_4;
goto LAB_0;
}
LAB_3:
/* ... block-copy loop with CcCopyRead/memset ... */
```
The check compares the caller-supplied LSN's container and block-offset components against the owner-page boundary (`local_f8`). If the LSN is beyond the boundary, the function bails out at `LAB_0` before any buffer copy executes.
### July 2026 Hardening (KB5101650)
The July 2026 patch further hardens `ReadLogBlock` (matched as `FUN_1400056a0` → `FUN_140005e00`, only 8% similarity due to heavy refactoring). The hardened version adds explicit `ClfsLsnBlockOffset` and `ClfsLsnContainer` calls to decompose LSN values before use, and introduces `FUN_1400044a0` for additional bounds validation. This closes edge cases where LSN components could individually pass the May check but produce an out-of-range combined offset.
---
## Affected Binary Versions
| **Binary** | **Version** | **Status** |
|---|---|---|
| clfs.sys | ≤ 10.0.28000.1896 (pre-May 2026) | Vulnerable |
| clfs.sys | 10.0.28000.2113 (May 2026, KB5089549) | Fixed (primary), feature-flagged |
| clfs.sys | 10.0.26100.8737 (pre-July 2026) | Residual edge cases |
| clfs.sys | 10.0.26100.8875 (July 2026, KB5101650) | Hardened |
---
## Detection Guidance
### YARA Rules
#### Rule 1 — Exploit Binary (memory/disk scan)
```yara
rule CVE_2026_40407_CLFS_Heap_Overflow_Exploit {
meta:
description = "Detects exploit binaries targeting CVE-2026-40407 CLFS ReadLogBlock heap overflow"
cve = "CVE-2026-40407"
severity = "CRITICAL"
author = "OnlyFm252 / STAR Labs SG"
date = "2026-07-22"
filetype = "PE"
strings:
/* CLFS Win32 APIs */
$api_create = "CreateLogFile" ascii wide
$api_add = "AddLogContainer" ascii wide
$api_read = "ReadLogRecord" ascii wide
$api_query = "QueryLogPolicy" ascii wide
/* BLF manipulation */
$blf_ext = ".blf" ascii wide nocase
$log_prefix = "LOG:" ascii wide
/* LSN manipulation — crafting out-of-range LSN */
$lsn_struct = "CLS_LSN" ascii
$lsn_create = "ClfsLsnCreate" ascii
/* Raw file I/O for BLF patching */
$patch_1 = "WriteFile" ascii wide
$patch_2 = "SetFilePointer" ascii wide
$patch_3 = "NtWriteFile" ascii
condition:
uint16(0) == 0x5A4D
and $api_create
and ($api_read or $api_query)
and $blf_ext
and 1 of ($patch_*)
}
```
#### Rule 2 — Malformed BLF with Out-of-Range LSN (on-disk artifact)
```yara
rule CVE_2026_40407_Malformed_BLF_LSN {
meta:
description = "Detects CLFS BLF files with suspicious LSN values exceeding owner-page boundaries"
cve = "CVE-2026-40407"
severity = "HIGH"
author = "OnlyFm252 / STAR Labs SG"
date = "2026-07-22"
filetype = "BLF"
strings:
/* CLFS base record signature */
$clfs_sig = { C5 0A C4 01 }
condition:
filesize < 2MB
and $clfs_sig
/* Owner page metadata is in the general metadata block.
An LSN with a container index > 0xFF or block offset > 0x7FFF
at typical owner-page positions is suspicious — legitimate CLFS
logs rarely use such extreme values. */
and for any i in (0x200, 0x400, 0x600):
(uint32(i + 4) > 0xFF and uint32(i) > 0x7FFF)
}
```
### Sigma Rules
#### Rule 1 — CLFS Log Read by Non-System Process
```yaml
title: CLFS Log Read API by Non-System Process (CVE-2026-40407)
id: c5d9e4f3-6a7b-4c8d-d9e0-1f2a3b4c5d6e
status: experimental
description: |
Detects non-system processes loading clfsw32.dll and performing log read
operations, which is a precursor to CVE-2026-40407 exploitation. The
ReadLogBlock heap overflow requires reading from a crafted BLF.
references:
- https://onlyfm252.starlabs.sg/cve/CVE-2026-40407/
author: OnlyFm252 / STAR Labs SG
date: 2026-07-22
tags:
- attack.privilege_escalation
- attack.t1068
- cve.2026.40407
logsource:
product: windows
category: image_load
detection:
selection_dll:
ImageLoaded|endswith: '\clfsw32.dll'
filter_system:
Image|endswith:
- '\svchost.exe'
- '\lsass.exe'
- '\services.exe'
- '\wininit.exe'
- '\System'
- '\smss.exe'
condition: selection_dll and not filter_system
level: medium
falsepositives:
- Legitimate applications using CLFS for transactional logging
- Database engines using CLFS
```
#### Rule 2 — BLF File Modification Pattern
```yaml
title: BLF File Write-Close-Reopen Pattern (CVE-2026-40407)
id: d6e0f5a4-7b8c-4d9e-e0f1-2a3b4c5d6e7f
status: experimental
description: |
Detects the create-close-patch-reopen pattern on BLF files that is
characteristic of CLFS exploitation. A process creates a BLF, closes it,
modifies it as a raw file, then reopens it via CreateLogFile.
references:
- https://onlyfm252.starlabs.sg/cve/CVE-2026-40407/
author: OnlyFm252 / STAR Labs SG
date: 2026-07-22
tags:
- attack.privilege_escalation
- attack.t1068
- cve.2026.40407
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: '.blf'
TargetFilename|contains:
- '\Users\'
- '\Temp\'
- '\Public\'
- '\AppData\'
filter_legitimate:
Image|endswith:
- '\svchost.exe'
- '\lsass.exe'
condition: selection and not filter_legitimate
level: high
falsepositives:
- Custom applications using CLFS for legitimate logging in user directories
```
### Sysmon Rules
```xml
.blf
\Users\;\Temp\;\Public\;\AppData\
clfsw32.dll
svchost.exe
lsass.exe
services.exe
_container.blf
\Users\;\Temp\;\Public\
```
---
## Remediation
1. **Apply patches immediately:** KB5089549 (May 2026) provides the primary fix; KB5101650 (July 2026) hardens the ReadLogBlock path further.
2. **Verify feature flag activation:** The fix is gated by `Feature_748929339`. Check flag status via `reg query "HKLM\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides"`.
3. **Deploy detection rules:** Use the YARA, Sigma, and Sysmon rules above.
4. **Monitor for BLF creation in user directories:** Legitimate CLFS usage rarely creates `.blf` files in `\Users\`, `\Temp\`, or `\Public\`.
5. **Enable Driver Verifier for clfs.sys** on high-value targets to catch heap corruption early.
---
## References
- Diff report: [clfs.sys KB5089549 diff (May 2026)](/data/patch_diffs/clfs_sys-kb5089549-40407.md)
- Diff report: [clfs.sys KB5101650 ghidriff diff (July 2026)](/data/patch_diffs/clfs_sys-kb5101650-ghidriff.md)
- Pre-patch binary: [clfs-2026-04.sys](/data/patch_diffs/binaries/clfs-2026-04.sys) (10.0.28000.1896)
- Post-patch binary: [clfs-2026-05.sys](/data/patch_diffs/binaries/clfs-2026-05.sys) (10.0.28000.2113)
- Related: [CVE-2026-40397](/cve/CVE-2026-40397/) (integer underflow, same patch)
Analysis by OnlyFm252 / STAR Labs SG. Diff source: ghidriff (Ghidra 12.0.4, VersionTrackingDiff engine).