FKIE_CVE-2026-2636

Vulnerability from fkie_nvd - Published: 2026-02-25 20:23 - Updated: 2026-04-15 00:35
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable.
References
df4dee71-de3a-4139-9588-11b62fe6c0ffhttps://www.fortra.com/security/advisories/research/fr-2026-001
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "This vulnerability is caused by a CWE\u2011159: \"Improper Handling of Invalid Use of Special Elements\" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable."
    },
    {
      "lang": "es",
      "value": "Esta vulnerabilidad se produce por un fallo CWE?159: \u0027Manejo Inadecuado del Uso Inv\u00e1lido de Elementos Especiales\u0027, lo que lleva a una inconsistencia irrecuperable en el controlador CLFS.sys. Esta condici\u00f3n fuerza una llamada a la funci\u00f3n KeBugCheckEx, permitiendo a un usuario sin privilegios provocar un fallo del sistema. Microsoft corrigi\u00f3 silenciosamente esta vulnerabilidad en la actualizaci\u00f3n acumulativa de septiembre de 2025 para Windows 11 2024 LTSC y Windows Server 2025. Windows 25H2 (lanzado en septiembre) fue lanzado con el parche. Windows 1123h2 y versiones anteriores siguen siendo vulnerables."
    }
  ],
  "id": "CVE-2026-2636",
  "lastModified": "2026-04-15T00:35:42.020",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-25T20:23:48.910",
  "references": [
    {
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
      "url": "https://www.fortra.com/security/advisories/research/fr-2026-001"
    }
  ],
  "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-159"
        }
      ],
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.