Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-28252: Windows CLFS driver can let attackers gain higher rights

CVE-2023-28252 · published 3 years ago · actively exploited

Summary

The Common Log File System driver in Windows versions 1507, 1607, 1809, and 20H2 has a flaw that could let a malicious program increase its privileges. This could allow an attacker to perform actions reserved for administrators. Install the latest Windows updates to patch the driver and limit the use of untrusted software.

What to do

Update microsoft windows_10_1507 to version 10.0.10240.19869 or later.
Update microsoft windows_10_1607 to version 10.0.14393.5850 or later.
Update microsoft windows_10_1809 to version 10.0.17763.4252 or later.
Update microsoft windows_10_20h2 to version 10.0.19042.2846 or later.
Update microsoft windows_10_21h2 to version 10.0.19044.2846 or later.
Update microsoft windows_10_22h2 to version 10.0.19045.2846 or later.
Update microsoft windows_11_21h2 to version 10.0.22000.1817 or later.
Update microsoft windows_11_22h2 to version 10.0.22621.1555 or later.

Affected software

Vendor	Product	Affected versions
microsoft	windows	All versions
microsoft	windows_10_1507	< 10.0.10240.19869 `cpe:2.3:o:microsoft:windows_10_1507::::::::`
microsoft	windows_10_1607	< 10.0.14393.5850 `cpe:2.3:o:microsoft:windows_10_1607::::::::`
microsoft	windows_10_1809	< 10.0.17763.4252 `cpe:2.3:o:microsoft:windows_10_1809::::::::`
microsoft	windows_10_20h2	< 10.0.19042.2846 `cpe:2.3:o:microsoft:windows_10_20h2::::::::`
microsoft	windows_10_21h2	< 10.0.19044.2846 `cpe:2.3:o:microsoft:windows_10_21h2::::::::`
microsoft	windows_10_22h2	< 10.0.19045.2846 `cpe:2.3:o:microsoft:windows_10_22h2::::::::`
microsoft	windows_11_21h2	< 10.0.22000.1817 `cpe:2.3:o:microsoft:windows_11_21h2::::::::`
microsoft	windows_11_22h2	< 10.0.22621.1555 `cpe:2.3:o:microsoft:windows_11_22h2::::::::`
microsoft	windows_server_2008	r2 `cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::`
microsoft	windows_server_2012	r2 `cpe:2.3:o:microsoft:windows_server_2012:-:::::::*`
microsoft	windows_server_2016	All versions `cpe:2.3:o:microsoft:windows_server_2016:-:::::::*`
microsoft	windows_server_2019	All versions `cpe:2.3:o:microsoft:windows_server_2019:-:::::::*`
microsoft	windows_server_2022	All versions `cpe:2.3:o:microsoft:windows_server_2022:-:::::::*`

Original advisory text

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

References

http://packetstormsecurity.com/files/174668/Windows-Common-Log-File-System-Drive... Exploit Third Party Advisory VDB Entry
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252 Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

49% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

CWE-787Out-of-bounds Write

Timeline

Published11 Apr 2023

Updated30 Sep 2026

First seen6 Mar 2026

Sources

CVE-2023-28252 · CISA KEV

CVE-2023-28252 · NVD

Track software like this

Free during beta