CVE-2023-36424
Published: 14 November 2023
Summary
CVE-2023-36424 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 6.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2023-36424 is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) Driver, stemming from an out-of-bounds read (CWE-125). The flaw affects the kernel-mode driver responsible for handling log files on Windows systems and carries a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, and low required privileges.
A local attacker with a low-privileged account can exploit the flaw to read memory beyond intended bounds, enabling escalation to higher privileges and full compromise of confidentiality, integrity, and availability on the affected host.
Microsoft has published updates addressing the issue through its Security Response Center, while CISA includes the CVE in its Known Exploited Vulnerabilities catalog, indicating that federal agencies must apply the patches according to the published timelines.
EPSS for the vulnerability rose from a low baseline to a peak of 0.2029 on 2025-12-11 before receding to the current value of 0.0976, demonstrating a clear post-disclosure increase in exploitation interest that later moderated.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-40389
Vulnerability details
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 13 April 2026
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires prompt application of vendor security updates to remediate the out-of-bounds read flaw in the CLFS driver before local attackers can exploit it for EoP.
Enforces least-privilege restrictions on processes and users, limiting the initial low-privilege foothold an attacker needs to trigger the CLFS vulnerability.
Verifies integrity of system files and drivers, enabling detection of unauthorized modifications or exploitation attempts against the vulnerable CLFS component.