CVE-2022-37969: Windows CLFS driver out-of-bounds write privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a high-CVSS local privilege escalation with confirmed exploitation and ransomware use per KEV, though it requires an existing foothold on the host.

What it is

The Windows Common Log File System (CLFS) driver contains an out-of-bounds write (CWE-787) that allows a local user to elevate privileges. It affects a broad range of Windows client and server releases, and CISA added it to the Known Exploited Vulnerabilities catalog with known ransomware campaign use, so it is a real-world target rather than a theoretical bug.

Impact

A local attacker can corrupt memory in the kernel driver and gain elevated privileges, typically SYSTEM, on the affected host. That level of access enables credential theft, disabling of security controls, and lateral movement or ransomware deployment.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have code execution or an interactive session on the machine. It is not remotely reachable and does not require a victim to open a file or click anything.

Exploitation

CISA added it to KEV on 2022-09-14 with a 2022-10-05 remediation due date and flags known ransomware campaign use; EPSS is 0.28275 (98th percentile). The references are patch and advisory links only, with no public exploit code cited in the record.

What to do

• Apply the Microsoft updates referenced in the MSRC advisory for CVE-2022-37969 to all affected Windows client and server versions.
• Prioritize internet-facing and high-value servers, and treat the CISA KEV due date of 2022-10-05 as the remediation deadline.
• Restrict and monitor local interactive and remote logon rights so untrusted users cannot run code on sensitive hosts.
• Enable tamper protection and endpoint detection on Windows systems, and verify ransomware defenses given the KEV ransomware flag.
• Track unpatched legacy platforms (Windows 7, 8.1, Server 2008/2012) that may no longer receive standard updates.

Detection

• Monitor for unexpected processes gaining SYSTEM or other elevated tokens shortly after a low-privileged process starts.
• Alert on suspicious access or manipulation of CLFS log files and the CLFS driver by non-standard processes.
• Hunt for known privilege-escalation tooling and post-exploitation behavior on hosts running unpatched Windows builds.
• Correlate local logon events with subsequent service creation, credential dumping, or security control tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.