CLFS

CLFS攻击 - CVE-2023-28252 自2022年2月起，据报道出现了一种新的勒索软件，据趋势科技的研究，该勒索软件似乎正在利用Windows 0day漏洞。有关此勒索软件的更多信息，可在此链接中找到。根据卡巴斯基的分析，自2022年6月以来，Nokoyawa勒索软件组织一直使用其他针对通用日志文件系统（CLFS）驱动程序的漏洞利用，这些漏洞利用具有相似但不同的特征，且均与同一位漏洞利用开发者相关。 @fortra @mcafee...

CVE-2021-43224-POC

CVE-2021-43224-POC Controlador del sistema de archivos de registro común de Windows POC quizás CVE-2021-43226 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43226 solo BSOD !!! probado en windows 20H2 ver 19042.1387...

CVE-2025-29824

CVE-2025-29824 win1021h2190445608x64 win1123h2226315126x64 testclient テストプログラム monitorclfssys clfsのすべてのIRP要求を監視するドライバ poc Crash ブルースクリーンPOC LPE win10poc win11poc ビルド基本情報 Windows SDK バージョン：10.0 最新インストールバージョン プラットフォームツールセット: Visual Studio 2022 v143 C++ 言語標準: デフォルト ISO C++14 標準...

SOC335-CVE-2024-49138-Exploitation-Detected

CVE-2024-49138 漏洞利用检测 在本项目中，我调查了 LetsDefend 平台上模拟的安全事件，其中一台 Windows 机器因利用 CVE-2024-49138（Windows 通用日志文件系统 CLFS 驱动程序中的特权提升漏洞）而受到入侵。攻击者利用此漏洞提升权限，并通过 RDP 建立远程访问。 关键收获 识别出 通过异常进程行为利用 CVE-2024-49138 的迹象。 分析了 使用伪装进程（svohost.exe）逃避检测的手法。 检测到 攻击链中使用了“就地取材”二进制文件（LOLBins）和 PowerShell 脚本。 映射到 MITRE ATT&CK...

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Time-of-check time-of-use toctou race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

PT-2026-70490

Name of the Vulnerable Software and Affected Versions Windows Common Log File System Driver affected versions not specified Description A time-of-check time-of-use toctou race condition exists in the Windows Common Log File System Driver. This occurs when a system checks a condition such as a...

CVE-2026-40397

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

Microsoft Windows Common Log File System Driver 数字错误漏洞

The Microsoft Windows Common Log File System Driver is a high-performance, general-purpose log file system API provided by Microsoft. It allows specialized client applications to utilize this subsystem, enabling multiple clients to share it for optimized log access. The Microsoft Windows Common L...

CVE-2026-2636 Denial of Service in Microsoft OS

This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash...

CVE-2026-2636 Denial of Service in Microsoft OS

This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash...

PT-2026-21986

Name of the Vulnerable Software and Affected Versions Windows versions prior to September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025 Windows 11 23H2 and earlier Description The issue is caused by improper handling of invalid use of special elements within the CLFS.sys...

EUVD-2020-2151

Malware in sbrugna...

EUVD-2016-4367

Malware in sbrugna...

VulnCheck KEV: CVE-2025-32706

Microsoft Windows Common Log File System CLFS Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally...

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Microsoft Windows Common Log File System CLFS Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally...

Patch Tuesday - April 2025

Microsoft is addressing 121 vulnerabilities this April 2025 Patch Tuesday, which is more than twice as many as last month. Microsoft has evidence of in-the-wild exploitation for just one of the vulnerabilities published today, which is already reflected in CISA KEV. Once again, Microsoft has...

Patch Tuesday, December 2024 Edition

Microsoft today released updates to plug at least 70 security holes in Windows and Windows software, including one vulnerability that is already being exploited in active attacks. The zero-day seeing exploitation involves CVE-2024-49138, a security weakness in the Windows Common Log File System...

The vulnerability of the Windows Common Log File System (CLFS) driver in Windows operating systems allows a hacker to elevate their privileges to the SYSTEM level.

The vulnerability of the Windows Common Log File System CLFS driver in Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level...

Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Microsoft Windows Common Log File System CLFS driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges...

The vulnerability of the CLFS driver for Microsoft Windows operating systems allows a hacker to gain increased privileges.

The vulnerability of the CLFS driver in Microsoft Windows operating systems is related to errors in privilege management. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level using a specially crafted blk-file...