CVE WatchSep 10, 2026

CVE-2022-37969

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

CVSS

7.8

High

EPSS

28.3%

p98

KEV

YES

Sep 14, 2022

Exploit Today

0-100

Published: Sep 13, 2022 · Last modified: Sep 10, 2026 · CWE-787

EPSS · 30d

28.3%EPSS · 30 days28.3%

2026-09-172026-10-15

KEV catalog record

Product

Microsoft / Windows

Vulnerability

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Added to KEV

Sep 14, 2022

Remediate by

Oct 5, 2022

Known ransomware use

Yes

Summary description

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

Required action

Apply updates per vendor instructions.

Notes

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37969; https://nvd.nist.gov/vuln/detail/CVE-2022-37969

Technical description

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1059587.5 HIG

—

———A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and write operations on the message buffer.1h CVE-2026-111458—

—

———The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.1h CVE-2026-1113828.8 HIG

—

———FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.11h CVE-2026-890625.5 MED

—

———A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.14h CVE-2026-1112807.4 HIG

—

———snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.16h CVE-2026-1112756.1 MED

—

———nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.16h