CVE-2021-43226

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVSS 7.8 HIGHEPSS 3.1%● KEV

Vexday Risk Score

71High priority

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Proof of concept

Popular PoC on GitHub (2 stars) — exploitation code widely available.

CVSS 7.8EPSS 3.1%KEV simPoC públicaNuclei —Metasploit —Patch —

Lifecycle

15 Dec 2021Published on NVD

30 Oct 2023Public PoC

06 Oct 2025Active exploitation (CISA KEV)

Weaponization speed

683 daysto first PoC

1390 daysto active exploitation (KEV)

Recommendation: Patch as soon as possible — active exploitation confirmed.

In short

A flaw in Windows' Common Log File System Driver allows a local attacker to gain higher privileges on the system. An authenticated user can exploit this to run malicious code with elevated permissions.

Technical detail

A privilege escalation vulnerability in the CLFS driver can be exploited by a local attacker with user-level access to execute arbitrary code with kernel privileges. The attack requires local code execution as a prerequisite and results in complete system compromise via kernel-level access.

Summary generated and translated by AI from the official description.

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected products

public PoCs found — 2

githubgithub.com/Rosayxy/cve-2021-43226PoC★ 2 vulncheckvulncheck.com/xdb/d3b41461a7f7unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43226 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43226