CVE Watch19 ago 2026

CVE-2023-23376

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

CVSS

7.8

Alto

EPSS

10.9%

p96

KEV

SÍ

14 feb 2023

Exploit Today

0-100

Publicado: 14 feb 2023 · Última mod.: 19 ago 2026 · CWE-122 · CWE-787

EPSS · 30d

10.9%EPSS · 30 días10.9%

2026-09-172026-10-15

Ficha del catálogo KEV

Producto

Microsoft / Windows

Vulnerabilidad

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Añadido a KEV

14 feb 2023

Remediar antes de

7 mar 2023

Uso conocido en ransomware

Sí

Descripción resumida

Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

Acción requerida

Apply updates per vendor instructions.

Notas

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23376; https://nvd.nist.gov/vuln/detail/CVE-2023-23376

Descripción técnica

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-111458—

—

———The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in addition to the two variable-length fields and a null terminator, requiring strlen(b64) + strlen(hex) + 34 bytes. This miscalculation results in a 3-byte heap-based buffer overflow on every invocation of the function with valid inputs. The overflow occurs because sprintf writes the full formatted string into the undersized heap buffer without bounds checking. An attacker who can supply a crafted pcap file containing a TLS X.509 certificate to a user running ssldump with FAN/1 fingerprinting enabled (for example with the -j -N options) can trigger the overflow. The resulting heap corruption may lead to denial of service through a crash or, in a worst-case scenario, arbitrary code execution in the context of the user running ssldump. The vulnerability is deterministic and requires no special privileges beyond the ability to provide input to the tool.6h CVE-2026-1113828.8 ALT

—

———FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past U/V planes, enabling heap corruption and potential code execution.9h CVE-2026-1113817.3 ALT

—

———FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry size accounting and fixed 16 KiB reads, leading to crashes or code execution when loaded.9h CVE-2026-1113797.3 ALT

—

———FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer and potentially execute code.9h CVE-2026-890625.5 MED

—

———A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.12h CVE-2026-1112807.4 ALT

—

———snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.14h