CVE-2023-36424
Microsoft Windows Out-of-Bounds Read Vulnerability
Description
CVE-2023-36424 is a HIGH-severity out-of-bounds read vulnerability in the Windows Common Log File System (CLFS) driver that enables local privilege escalation on Microsoft Windows. The flaw carries a CVSS 3.1 score of 7.8 and affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2008 through 2022. An authenticated local attacker with low privileges can exploit CVE-2023-36424 to elevate to SYSTEM, giving them full control of the affected host. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, which confirms active real-world exploitation, and its EPSS score of 0.05545 (90.3rd percentile) signals an elevated risk of continued attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20308 |
| microsoft | windows 10 1607 | < 10.0.14393.6452 |
| microsoft | windows 10 1809 | < 10.0.17763.5122 |
| microsoft | windows 10 21h2 | < 10.0.19044.3693 |
| microsoft | windows 10 22h2 | < 10.0.19045.3693 |
| microsoft | windows 11 21h2 | < 10.0.22000.2600 |
| microsoft | windows 11 22h2 | < 10.0.22621.2715 |
| microsoft | windows 11 23h2 | < 10.0.22631.2715 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.6452 |
| microsoft | windows server 2019 | < 10.0.17763.5122 |
| microsoft | windows server 2022 | < 10.0.20348.2091 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.531 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36424(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36424(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
CVE-2023-36424 is classified under CWE-125 — Out-of-bounds Read. This weakness occurs when software reads data from a memory location outside the intended boundaries of a buffer, typically because array indices, pointer arithmetic, or buffer offsets are calculated incorrectly or not properly validated. In the Windows Common Log File System driver, an attacker-controlled log structure causes the kernel to read beyond the allocated buffer, exposing memory that can be leveraged to bypass kernel protections and escalate privileges to SYSTEM.
Learn more: CWE-125 — Out-of-bounds Read
Impact Analysis
CVE-2023-36424 carries a CVSS 3.1 score of 7.8 (HIGH) with an unchanged scope, meaning the impact is contained within the vulnerable Windows kernel component but on a single host remains severe. Attack Vector (Local): an attacker must already have code execution on the target, typically as a standard user, and exploitation is not remotely reachable. Attack Complexity (Low): no special timing, configuration, or environmental conditions are required to trigger the out-of-bounds read. Privileges Required (Low): a basic authenticated user is sufficient, which means any malware running in user context or a logged-in attacker can weaponize the flaw. User Interaction (None): once the attacker runs the exploit, no additional action from the victim is needed. Confidentiality, Integrity, and Availability (all High): successful exploitation yields full SYSTEM privileges on Microsoft Windows, allowing attackers to read any data on the host, install persistent implants, disable security tooling, and crash or render the machine unusable. With an EPSS score of 0.05545 in the 90.3rd percentile and confirmed inclusion in CISA's KEV catalog, organizations should treat CVE-2023-36424 as an actively exploited privilege escalation vulnerability that demands immediate remediation.
Exploit Maturity
CVE-2023-36424 is confirmed as actively exploited and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-04-13 with a federal remediation deadline of 2026-04-27, so defenders should treat it as a current in-the-wild threat rather than a theoretical risk. The EPSS score of 0.05545 at the 90.3rd percentile places CVE-2023-36424 among the top decile of vulnerabilities by expected exploitation activity, consistent with the pattern of Windows CLFS privilege escalation flaws being rapidly weaponized. KEV data does not flag known ransomware use for this CVE, but historical precedent shows that CLFS elevation-of-privilege bugs are routinely bundled into commodity loaders and post-exploitation toolkits to convert initial footholds into full domain compromise. No standalone public exploit URL is present in the NVD references for CVE-2023-36424, however the vulnerability's KEV status and its similarity to previously weaponized CLFS flaws strongly suggest working exploit code exists in private toolkits; organizations should patch immediately and monitor vendor and CISA advisories for updates.
Remediation
- Apply the Microsoft security update for CVE-2023-36424 immediately. Per CISA's KEV required action, apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The official advisory is available at the Microsoft Security Response Center.
- Identify and update every affected Windows build. Fixed builds include Windows 10 1507 ≥ 10.0.10240.20308, Windows 10 1607 ≥ 10.0.14393.6452, Windows 10 1809 ≥ 10.0.17763.5122, Windows 10 21H2/22H2 ≥ 10.0.19044/19045.3693, Windows 11 21H2 ≥ 10.0.22000.2600, Windows 11 22H2/23H2 ≥ 10.0.22621/22631.2715, Windows Server 2016 ≥ 10.0.14393.6452, Windows Server 2019 ≥ 10.0.17763.5122, Windows Server 2022 ≥ 10.0.20348.2091, and Windows Server 2022 23H2 ≥ 10.0.25398.531. Windows Server 2008 and 2012 should be patched with the corresponding monthly rollup.
- Restrict local code execution paths to the kernel driver. Until patching is complete, enforce application allow-listing (Windows Defender Application Control or AppLocker), remove local administrator rights where not required, and apply attack surface reduction rules to limit which user-mode processes can interact with the Common Log File System.
- Hunt for exploitation and post-exploitation activity. Because CVE-2023-36424 is on the KEV list, review endpoint and SIEM telemetry for unexpected SYSTEM-level process creation from user accounts, anomalous CLFS log file activity (unusual .blf or .bfx file writes), and kernel crashes referencing clfs.sys.
- Update EDR and detection signatures. Ensure your endpoint detection and response tooling and IDS/IPS rules are refreshed with vendor detections for CLFS-based privilege escalation exploits, and prioritize alerts on privilege escalation patterns.
- Apply defense-in-depth for kernel memory safety. As a long-term hardening measure against CWE-125 out-of-bounds read flaws in Windows kernel components, enable Hypervisor-Protected Code Integrity (HVCI), Credential Guard, and Kernel DMA Protection, and ensure Virtualization-Based Security (VBS) is active where hardware permits.
Technical Details
CVE-2023-36424 is an out-of-bounds read in the Windows Common Log File System (CLFS) driver (clfs.sys), the kernel-mode component that manages transactional log files used by multiple Windows subsystems. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local, low-complexity attack that requires only low privileges and no user interaction. Vulnerability mechanism: an attacker crafts a malformed CLFS log structure (.blf) whose internal offsets or size fields cause the driver to read beyond the bounds of an allocated buffer. Because the calculations are performed in kernel context without sufficient bounds validation, the leaked data can reveal kernel pointers and structures that defeat Kernel Address Space Layout Randomization (KASLR) and support subsequent memory corruption. Exploitation chain: the disclosed kernel information is typically combined with a follow-on memory corruption primitive to hijack kernel control flow, ultimately producing a token-stealing primitive that swaps the current process token with a SYSTEM token. Impact profile: the Unchanged scope confines the immediate impact to the local host, but the HIGH/HIGH/HIGH confidentiality, integrity, and availability ratings reflect that full SYSTEM access compromises everything on that machine — credentials, endpoint security agents, and any data the host can reach.
Frequently Asked Questions
Is CVE-2023-36424 being actively exploited?
Yes. CVE-2023-36424 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means CISA has confirmed active exploitation in the wild. Its EPSS score of 0.05545 (90.3rd percentile) further indicates a high likelihood of continued attacks, and U.S. federal agencies were required to remediate by 2026-04-27.
What products are affected by CVE-2023-36424?
CVE-2023-36424 affects a broad range of Microsoft Windows releases: Windows 10 (builds 1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2. Any supported Windows host running a build below the fixed Common Log File System driver version should be considered vulnerable until patched.
How do I fix CVE-2023-36424?
Apply the Microsoft security update referenced in the MSRC advisory for CVE-2023-36424 and verify that every affected Windows host is running the fixed build (for example Windows 11 22H2 ≥ 10.0.22621.2715 or Windows Server 2022 ≥ 10.0.20348.2091). Until patching completes, restrict local administrator rights, enable Hypervisor-Protected Code Integrity and Virtualization-Based Security, and hunt for signs of CLFS-based privilege escalation.
How severe is CVE-2023-36424?
CVE-2023-36424 is rated HIGH with a CVSS 3.1 score of 7.8. A successful exploit yields full SYSTEM privileges on the affected Windows host, with HIGH impact on confidentiality, integrity, and availability, and its EPSS score of 0.05545 places it in the 90.3rd percentile for exploitation likelihood — a strong signal that this Windows privilege escalation vulnerability should be prioritized.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.