Vulnerability Spotlight: Privilege escalation in Windows 10 CLFS driver

Summary: Cisco Talos discovered a privilege escalation vulnerability in the Windows 10 Common Log File System, tracked as TALOS-2020-1098/CVE-2020-1115, in which a malformed log file triggers a heap buffer overflow in the CLFS.sys ValidateRegionBlocks functionality. A regular user must open the crafted log file to trigger the bug, but because it executes at the kernel level it grants the adversary elevated privileges, and Microsoft patched it in its monthly security update Tuesday.
What's compelling: The trigger is a log file opened by an ordinary user, so the path to kernel-level code execution runs through routine file handling rather than an administrator action, and Talos confirmed the flaw in CLFS.SYS 10.0.19041.264 and Insider Preview 10.0.20150.1000.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-1115
Related: Microsoft Patch Tuesday for Sept. 2020 — Snort rules and prominent vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026