CVEs / CVE-2023-28252

CVE-2023-28252: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Known exploited in the CISA KEV catalog since 11 Apr 2023
high 7.8 CVSS 3.1 (from the CNA)
EPSS 48.8% chance of exploitation in the next 30 days, higher than 98% of CVEs (30 Oct 2026)
Last changed at its sources 17 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2023-28252

Summary

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
CISA, Known Exploited Vulnerabilities catalog

Description

Windows Common Log File System Driver Elevation of Privilege Vulnerability
The CVE record, via NVD · published 11 Apr 2023 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Microsoft Windows 10 Version 1809	from 10.0.17763.0, before 10.0.17763.4252	10.0.17763.4252
Microsoft Windows 10 Version 1809	from 10.0.0, before 10.0.17763.4252	10.0.17763.4252
Microsoft Windows Server 2019	from 10.0.17763.0, before 10.0.17763.4252	10.0.17763.4252
Microsoft Windows Server 2019 (Server Core installation)	from 10.0.17763.0, before 10.0.17763.4252	10.0.17763.4252
Microsoft Windows Server 2022	from 10.0.20348.0, before 10.0.20348.1668	10.0.20348.1668
Microsoft Windows 10 Version 20H2	from 10.0.0, before 10.0.19042.2846	10.0.19042.2846
Microsoft Windows 11 version 21H2	from 10.0.0, before 10.0.22000.1817	10.0.22000.1817
Microsoft Windows 10 Version 21H2	from 10.0.19043.0, before 10.0.19044.2846	10.0.19044.2846
Microsoft Windows 11 version 22H2	from 10.0.22621.0, before 10.0.22621.1555	10.0.22621.1555
Microsoft Windows 10 Version 22H2	from 10.0.19045.0, before 10.0.19045.2846	10.0.19045.2846
Microsoft Windows 10 Version 1507	from 10.0.10240.0, before 10.0.10240.19869	10.0.10240.19869
Microsoft Windows 10 Version 1607	from 10.0.14393.0, before 10.0.14393.5850	10.0.14393.5850
Microsoft Windows Server 2016	from 10.0.14393.0, before 10.0.14393.5850	10.0.14393.5850
Microsoft Windows Server 2016 (Server Core installation)	from 10.0.14393.0, before 10.0.14393.5850	10.0.14393.5850
Microsoft Windows Server 2008 Service Pack 2	from 6.0.6003.0, before 6.0.6003.22015	6.0.6003.22015
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)	from 6.0.6003.0, before 6.0.6003.22015	6.0.6003.22015
Microsoft Windows Server 2008 Service Pack 2	from 6.0.6003.0, before 6.0.6003.22015	6.0.6003.22015
Microsoft Windows Server 2008 R2 Service Pack 1	from 6.1.7601.0, before 6.1.7601.26466	6.1.7601.26466
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)	from 6.1.7601.0, before 6.1.7601.26466	6.1.7601.26466
Microsoft Windows Server 2012	from 6.2.9200.0, before 6.2.9200.24216	6.2.9200.24216
Microsoft Windows Server 2012 (Server Core installation)	from 6.2.9200.0, before 6.2.9200.24216	6.2.9200.24216
Microsoft Windows Server 2012 R2	from 6.3.9600.0, before 6.3.9600.20919	6.3.9600.20919
Microsoft Windows Server 2012 R2 (Server Core installation)	from 6.3.9600.0, before 6.3.9600.20919	6.3.9600.20919

Exploitation

In CISA KEV since	11 Apr 2023
Due date for US federal agencies	2 May 2023
Used in ransomware campaigns	Known
Required action	Apply updates per vendor instructions.

Severity

CVSS 3.1	7.8 high `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` Scored by the CNA ([email protected])
Weakness	CWE-122, CWE-787

References

CVE-2023-28252 on NVD
CVE-2023-28252 in the CISA KEV catalog
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252 (cited by CISA)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252 Patch, Vendor Advisory
http://packetstormsecurity.com/files/174668/Windows-Common-Log-File-System-Driver-clfs.sys-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28252 US Government Resource

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.