Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-28252 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability CVE-2023-28252 is an elevation of privilege flaw in the Windows Common Log File System Driver (clfs.sys) stemming from a heap-based buffer overflow and out-of-bounds write, as indicated by the associated CWEs. It affects supported versions of Windows and carries a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, and low privileges required for successful exploitation with high impact on confidentiality, integrity, and availability.
A local attacker with low-privileged access on an affected system can exploit the driver flaw to escalate privileges, potentially gaining full control over the target machine. Public exploit code has been posted to sites such as Packet Storm, confirming the technical feasibility of the attack.
Microsoft's advisory directs administrators to apply the security updates released on April 11, 2023, while CISA lists the CVE in its Known Exploited Vulnerabilities catalog and requires federal agencies to remediate in accordance with Binding Operational Directive 22-01.
The vulnerability shows confirmed real-world exploitation, with an EPSS score that has reached a peak of 0.7018 and currently sits at 0.5998.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31960
Vulnerability Data
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 11 April 2023
Related Threats
Threat-Actor AttributionAI
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.
Timely patching removes known heap-overflow instances after they exist.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.