OnlyPatch
Windows Common Log File System Driver

CVE-2026-62728 — Windows Common Log File System Driver Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00189 🔬 Patch diffed 2026-08 archive

Executive Summary

Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Exploitation Unlikely
MS Exploit Likelihood
Category Elevation of Privilege
Released Aug 11 2026
Last Updated Aug 11 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00189 — 0.08749 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00189
probability of exploitation in the next 30 days
0.08749 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

22 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5120418 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5120418 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5120238 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5120238 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5120240 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5120240 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5120994 (Security Hotpatch Update) 5121003 (Security Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.9106 10.0.26100.9168 Yes None Windows 11 Version 24H2 for x64-based Systems 5121003 (Security Update) 5120994 (Security Hotpatch Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.9168 10.0.26000.9106 Yes None Windows 11 Version 25H2 for ARM64-based Systems 5121003 (Security Update) 5120994 (Security Hotpatch Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.9168 10.0.26100.9106 Yes None Windows 11 Version 25H2 for x64-based Systems 5121003 (Security Update) 5120994 (Security Hotpatch Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.9168 10.0.26100.9106 Yes None Windows 11 Version 26H1 for ARM64-based Systems 5121000 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5121000 (Security Update) Important Elevation of Privilege Yes
Windows Server 2012 5120386 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 (Server Core installation) 5120386 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 5120385 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2012 R2 (Server Core installation) 5120385 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2016 5120418 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5120418 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5120238 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5120238 (Security Update) Important Elevation of Privilege Yes

Patches

7 patches
Article Type Restart
5120418 Security Update Yes
5120238 Security Update Yes
5120249 Security Update Yes
5120240 Security Update Yes
5121000 Security Update Yes
5120386 Monthly Rollup Yes
5120385 Monthly Rollup Yes

Patch Diff

ghidriff · clfs.sys (KB5121003)

Double-fetch (CWE-367) of the log block sector count in clfs.sys ClfsValidateBlock. The bounds check param_3 < count << 9 used one read of *(ushort *)(param_2 + 4), but the sector-walk loop re-read the same attacker-controlled header field on every iteration for its termination condition. If the field changes between check and walk, the loop indexes param_2[i * 0x200 + 0x1fe] past the validated extent. Reached from CreateLogFile -> ReadLogBlock -> CompleteAsyncReadBlock -> ValidateLogBlock -> ClfsValidateBlock; the async completion path is what makes a mid-validation mutation conceivable. Patch captures the count once into a local and uses it for both the bound and the loop, and refactors per-sector flag checks into ClfsValidateSector. Gated behind Feature_344697147, so the double-fetch path still ships and runs when the flag is off. ReadLogBlock also changed here, but gated by the SAME Feature_344697147 - part of this fix, not a re-fix of CVE-2026-40407 (whose Feature_748929339 is absent from the 26100 branch). Investigated and ruled out as a variant pair.

Pre-patch version 10.0.26100.8972
Post-patch version 10.0.26100.9168
Function Address Change Note
ClfsValidateBlock code (double fetch removed, gated on Feature_344697147) Pre-patch loop condition re-read *(ushort *)(param_2 + 4) each iteration while the bounds check used an earlier read of the same field. Patch captures it once into uVar2 and uses that for both. Both branches ship in 10.0.26100.9168.
CClfsLogFcbPhysical::ValidateLogBlock 140008bb0 code Caller. Carries a 128-bit overflow guard on 0x200 * sectorCount that cannot fire (ushort operand), and passes the expected sector signature as (uchar)param_2[2] - read from the same header being validated, so it is a torn-write detector rather than a security check.
CClfsLogFcbPhysical::CompleteAsyncReadBlock code Async completion path that walks a multi-block buffer and calls ValidateLogBlock per block. The asynchronous context is what makes a mid-validation mutation of the header plausible.
CClfsLogFcbPhysical::ReadLogBlock code (part of the same Feature_344697147 fix) Gated by Feature_344697147 at 14000f6ba and 14000f717 - i.e. part of THIS fix, not a re-fix of CVE-2026-40407. Feature_748929339 (the May CVE-2026-40407 flag) is absent from clfs.sys 10.0.26100.9168 entirely; that fix lives on the 10.0.28000.x Server branch. Same function, different branches, different defects - not a variant pair.
CClfsLogFcbPhysical::IsEof code Participates in the same block read path.
Feature_344697147__private_IsEnabledDeviceUsageNoInline / _IsEnabledFallback added -- CFR gate Controlled Feature Rollout flag selecting between the fixed and original code. Patch state cannot be inferred from file version.
View full diff report View RCA report

Attack Path

Double-fetch of the block sector count: validation and the sector walk read the same attacker-controlled header field separately

Attack path for CVE-2026-62728 Double-fetch of the block sector count: validation and the sector walk read the same attacker-controlled header field separately Attacker Block buffer (.blf) ClfsValidateBlock CreateLogFile in a user-writable directory, drive log read activity 1 CLFS is a core kernel component on every install and log files need no privilege to create. Reads reach CClfsLogFcbPhysical::ReadLogBlock -> CompleteAsyncReadBlock. Block header carries the sector count at +0x4, fully attacker-chosen 2 Bounds check: param_3 < (count << 9), using ONE read of +0x4 3 This proves the block fits the buffer for the value just read. ClfsValidateSector is then called on the first sector. Sector-walk loop RE-READS +0x4 every iteration for its termination test 4 Pre-patch: `if (*(ushort *)(param_2 + 4) - 1 <= uVar8) break;`. The bound that was validated and the bound that controls the loop are two separate reads of attacker-controlled memory - CWE-367. Field mutated between the check and the walk 5 Requires the buffer to be mutable mid-validation. ClfsValidateBlock is reached from an ASYNC read completion, which is what makes this conceivable - but this analysis does not establish a concrete mutation primitive. Loop indexes param_2[i * 0x200 + 0x1fe] past the validated extent 6 Out-of-bounds access on the sector signature/flag bytes beyond the region the bounds check licensed. Patch captures the count once; gated behind Feature_344697147, so the original path still runs when the flag is off.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Daejin Lee
sweetchip
Kentaro Kawane with GMO Cybersecurity by Ierae, Inc.

On This Page