CVE-2021-43226
Microsoft Windows Privilege Escalation Vulnerability
Description
CVE-2021-43226 is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) Driver affecting multiple versions of Microsoft Windows 10. This local privilege escalation flaw allows an authenticated attacker with low privileges to gain SYSTEM-level access on the affected machine. With an EPSS score of 0.07549 (91.7th percentile) and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 27, 2025, this vulnerability represents a serious threat to Windows environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19145 |
| microsoft | windows 10 1607 | < 10.0.14393.4825 |
| microsoft | windows 10 1809 | < 10.0.17763.2366 |
| microsoft | windows 10 1909 | < 10.0.18363.1977 |
| microsoft | windows 10 2004 | < 10.0.19041.1415 |
| microsoft | windows 10 20h2 | < 10.0.19042.1415 |
| microsoft | windows 10 21h1 | < 10.0.19043.1415 |
| microsoft | windows 10 21h2 | < 10.0.19044.1415 |
| microsoft | windows 11 21h2 | < 10.0.22000.376 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1415 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4825 |
| microsoft | windows server 2019 | < 10.0.17763.2366 |
| microsoft | windows server 2022 | < 10.0.20348.405 |
| microsoft | windows server 20h2 | < 10.0.19042.1415 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43226(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43226(US Government Resource)
Weakness Type
No Specific CWE Assigned
Microsoft has not assigned a specific CWE identifier to CVE-2021-43226. However, based on the vulnerability's characteristics as a privilege escalation in the CLFS driver, it likely involves memory corruption or improper input validation within the kernel-mode driver. The Common Log File System driver operates at a high privilege level in the Windows kernel, and vulnerabilities in this component have historically been associated with weaknesses such as improper memory handling, race conditions, or insufficient validation of user-supplied data passed from user mode to kernel mode.
Impact Analysis
The business impact of CVE-2021-43226 is significant because it enables full system compromise through local privilege escalation. Confidentiality Impact is high as an attacker who escalates to SYSTEM privileges can access all data on the machine, including credentials stored in the Security Account Manager (SAM), cached domain credentials, and any encrypted files protected by the user's profile. Integrity Impact is high because SYSTEM-level access allows the attacker to modify any file on the system, install rootkits, tamper with security logs, and alter system configurations to maintain persistent access. Availability Impact is high since SYSTEM access enables the attacker to stop critical services, corrupt the operating system, or render the system unusable. The attack requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L), meaning any authenticated user on the system can exploit this vulnerability without any special conditions or user interaction. The EPSS score of 0.07549 (91.7th percentile) indicates a high probability of exploitation. The KEV catalog listing with ransomware status "Unknown" highlights the risk, as CLFS driver vulnerabilities have been a favorite target of ransomware operators who use them to escalate from an initial foothold to full system control.
Exploit Maturity
CVE-2021-43226 has confirmed active exploitation in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of October 27, 2025. The ransomware association is listed as "Unknown," though it is worth noting that CLFS driver vulnerabilities have been repeatedly exploited by ransomware groups in recent years, making this a likely target for such campaigns. The EPSS score of 0.07549 (91.7th percentile) indicates elevated exploitation probability. Microsoft published a security advisory confirming the vulnerability and providing patches. While no widely published standalone proof-of-concept exploit has been identified in public repositories, the confirmed KEV status indicates that threat actors have developed working exploitation techniques. The CLFS driver has been a recurring attack surface, with multiple similar vulnerabilities discovered in the same component, suggesting that exploit developers have deep familiarity with this attack vector.
Remediation
- Install the December 2021 Windows security updates. Apply the cumulative update from Microsoft that patches CVE-2021-43226, available through Windows Update or the Microsoft Security Response Center advisory. Ensure all affected Windows 10 versions are updated to at least the following builds: 10.0.10240.19145 (1507), 10.0.14393.4825 (1607), 10.0.17763.2366 (1809), 10.0.18363.1977 (1909), 10.0.19041.1415 (2004), 10.0.19042.1415 (20H2), 10.0.19043.1415 (21H1), or 10.0.19044.1415 (21H2).
- Prioritize patching based on exposure. Focus first on systems that are accessible to multiple users, internet-facing servers, and machines in environments where lateral movement could occur. Systems that have already been compromised through other vectors are prime candidates for CLFS exploitation as a privilege escalation step.
- Upgrade to a supported Windows version. Older Windows 10 versions such as 1507, 1607, 1809, and 1909 have reached or are nearing end of servicing. Migrate to Windows 10 22H2 or Windows 11 to ensure continued security update coverage.
- Implement least privilege access controls. Since the vulnerability requires local authenticated access, limit the number of users who have interactive logon rights to sensitive systems. Use Group Policy to restrict local logon permissions and enforce the principle of least privilege.
- Monitor for CLFS-related exploitation indicators. Watch for suspicious CLFS log file (.blf) creation or manipulation, unexpected SYSTEM-level process spawning from low-privilege user contexts, and anomalous activity in the Windows Common Log File System driver. Endpoint detection and response (EDR) tools should be configured with rules to detect CLFS exploitation patterns.
Technical Details
The CVSS v3.1 vector for CVE-2021-43226 is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a score of 7.8 (High). Attack Vector (AV:L) indicates the attacker must have local access to the system, either through a direct login session, remote desktop, or post-exploitation lateral movement. Attack Complexity (AC:L) is low, meaning the exploitation is reliable and does not depend on race conditions or other probabilistic factors. Privileges Required (PR:L) is low, confirming that any standard authenticated user can trigger the vulnerability without needing administrator or special privileges. User Interaction (UI:N) is none, so no action from another user is required. Scope (S:U) is unchanged, meaning the privilege escalation occurs within the Windows security context. All three impact metrics — Confidentiality (C:H), Integrity (I:H), and Availability (A:H) — are rated high, reflecting full SYSTEM-level compromise.
The vulnerability resides in the Windows Common Log File System (CLFS) driver, specifically in how the clfs.sys kernel-mode driver processes log file structures. CLFS is a general-purpose logging framework used by Windows for transaction logging, Active Directory, and various system services. The driver processes Base Log File (.blf) metadata structures that contain block descriptors and context information. The vulnerability occurs when the CLFS driver improperly handles crafted log file metadata, leading to a condition where the attacker can corrupt kernel memory. By creating or manipulating a CLFS log file with specially crafted metadata, a local attacker can trigger the vulnerability to write controlled data to kernel memory, ultimately overwriting critical kernel structures to escalate privileges from a standard user to SYSTEM. This attack pattern is consistent with other CLFS vulnerabilities that have been discovered, reflecting a systemic weakness in how the driver validates and processes log file structures.
Frequently Asked Questions
What is the Windows Common Log File System Driver?
The Common Log File System (CLFS) is a high-performance, general-purpose log file subsystem built into the Windows operating system. It is used by multiple Windows components including the Kernel Transaction Manager (KTM), Active Directory, and SQL Server for transactional logging. The CLFS driver (clfs.sys) operates in kernel mode, which is why vulnerabilities in this component can lead to full system compromise.
How severe is CVE-2021-43226?
CVE-2021-43226 is rated High severity with a CVSS score of 7.8. It allows any authenticated user to escalate privileges to SYSTEM level, which represents complete control over the affected Windows machine. Its inclusion in CISA's KEV catalog confirms it has been exploited in real-world attacks.
Which Windows versions are affected by CVE-2021-43226?
The vulnerability affects Windows 10 versions 1507, 1607, 1809, 1909, 2004, 20H2, 21H1, and 21H2 prior to the December 2021 security updates. Organizations running any of these versions without the cumulative update should patch immediately or upgrade to a newer, supported release.
Why are CLFS driver vulnerabilities frequently targeted by attackers?
The CLFS driver is an attractive target because it runs in kernel mode with the highest system privileges, its log file format can be manipulated by low-privilege users, and exploitation tends to be reliable with low complexity. Ransomware operators particularly favor CLFS vulnerabilities because they provide a dependable path from initial user-level access to the SYSTEM privileges needed to encrypt files and disable security tools.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.