CVE-2022-24521

Deeper analysis

The vulnerability CVE-2022-24521 is an elevation-of-privilege flaw in the Windows Common Log File System (CLFS) Driver, stemming from an out-of-bounds write condition (CWE-787). It affects Windows systems that include this kernel-mode driver component and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low complexity, and low required privileges.

A local attacker who already possesses a low-privileged user account on an affected Windows host can exploit the flaw to execute arbitrary code with elevated privileges, typically resulting in full control over confidentiality, integrity, and availability of the system. Successful exploitation allows the attacker to bypass normal access controls and obtain SYSTEM-level rights without user interaction.

Microsoft has published security updates that address the issue, and the vulnerability appears in CISA’s Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation. The associated EPSS score has remained in a narrow band between 0.0749 and a peak of 0.0868, indicating modest but persistent exploitation interest after disclosure.