This critical vulnerability in the Microsoft Common Log File System driver is actively exploited in the wild and enables local attackers to escalate privileges to SYSTEM level.

This is an elevation of privilege vulnerability occurring within the Windows Common Log File System (CLFS) driver. A local authenticated attacker can leverage this flaw to trigger a buffer overflow, subsequently gaining SYSTEM level code execution on the target machine.

The CVSS score of 9.5 classifies this as a critical risk, primarily because it grants an attacker full control over the compromised host. Once an attacker achieves SYSTEM level access, they can bypass security controls, install persistent malware, or move laterally within the network. The inclusion of this vulnerability in the CISA Known Exploited Vulnerabilities catalog further elevates the urgency for immediate remediation.

Immediate Action: Apply the relevant security updates provided by Microsoft through Windows Update or Windows Server Update Services (WSUS) immediately.

Proactive Monitoring: Monitor system logs for unexpected crashes or errors related to the CLFS driver and audit for unauthorized attempts to execute high-privilege operations by standard user accounts.

Compensating Controls: Ensure that endpoint detection and response (EDR) solutions are active and configured to alert on suspicious process spawning or unauthorized access attempts to kernel-mode drivers.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in GitHub repositories.

Given the confirmed active exploitation by ransomware groups and the potential for full system compromise, this vulnerability poses an extreme risk to organizational integrity. IT administrators must prioritize the deployment of the necessary Microsoft security updates across all affected server and workstation environments to prevent unauthorized privilege escalation and subsequent malicious activity.