CVE-2026-2636

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2636", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "state": "PUBLISHED", "assignerShortName": "Fortra", "dateReserved": "2026-02-17T18:49:03.493Z", "datePublished": "2026-02-25T18:57:02.962Z", "dateUpdated": "2026-02-26T15:56:55.089Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Windows OS", "vendor": "Microsoft", "versions": [{"lessThan": "25H2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "1123h2", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This vulnerability is caused by a CWE\u2011159: \"Improper Handling of Invalid Use of Special Elements\" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable."}], "value": "This vulnerability is caused by a CWE\u2011159: \"Improper Handling of Invalid Use of Special Elements\" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable."}], "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-159", "description": "CWE-159 Improper Handling of Invalid Use of Special Elements", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-02-25T18:57:02.962Z"}, "references": [{"url": "https://www.fortra.com/security/advisories/research/fr-2026-001"}], "source": {"discovery": "UNKNOWN"}, "title": "Denial of Service in Microsoft OS", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:56:12.707562Z", "id": "CVE-2026-2636", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:56:55.089Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2636", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:56:12.707562Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:56:46.427Z"}}], "cna": {"title": "Denial of Service in Microsoft OS", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-153", "descriptions": [{"lang": "en", "value": "CAPEC-153 Input Data Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Windows OS", "versions": [{"status": "affected", "version": "0", "lessThan": "25H2", "versionType": "semver"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1123h2"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.fortra.com/security/advisories/research/fr-2026-001"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "This vulnerability is caused by a CWE\u2011159: \"Improper Handling of Invalid Use of Special Elements\" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable.", "supportingMedia": [{"type": "text/html", "value": "This vulnerability is caused by a CWE\u2011159: \"Improper Handling of Invalid Use of Special Elements\" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-159", "description": "CWE-159 Improper Handling of Invalid Use of Special Elements"}]}], "providerMetadata": {"orgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "shortName": "Fortra", "dateUpdated": "2026-02-25T18:57:02.962Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2636", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:56:55.089Z", "dateReserved": "2026-02-17T18:49:03.493Z", "assignerOrgId": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "datePublished": "2026-02-25T18:57:02.962Z", "assignerShortName": "Fortra"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Windows OS", "vendor": "Microsoft", "versions": [{"lessThan": "25H2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "1123h2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability is caused by a CWE\u2011159: \"Improper Handling of Invalid Use of Special Elements\" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable."}, {"lang": "es", "value": "Esta vulnerabilidad se produce por un fallo CWE?159: 'Manejo Inadecuado del Uso Inv\u00e1lido de Elementos Especiales', lo que lleva a una inconsistencia irrecuperable en el controlador CLFS.sys. Esta condici\u00f3n fuerza una llamada a la funci\u00f3n KeBugCheckEx, permitiendo a un usuario sin privilegios provocar un fallo del sistema. Microsoft corrigi\u00f3 silenciosamente esta vulnerabilidad en la actualizaci\u00f3n acumulativa de septiembre de 2025 para Windows 11 2024 LTSC y Windows Server 2025. Windows 25H2 (lanzado en septiembre) fue lanzado con el parche. Windows 1123h2 y versiones anteriores siguen siendo vulnerables."}], "id": "CVE-2026-2636", "lastModified": "2026-06-17T10:31:26.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2636", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:56:12.707562Z", "version": "2.0.3"}}]}, "published": "2026-02-25T20:23:48.910", "references": [{"source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "url": "https://www.fortra.com/security/advisories/research/fr-2026-001"}], "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-159"}], "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,25H2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1123h2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Windows OS", "source": "cna", "vendor": "Microsoft"}, "product": "windows", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "windows_11", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "windows_11_23h2", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "windows_11_25h2", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "windows_server_2025", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-18T10:37:28.512517+00:00", "value": {"mitigation_remediation": ["Install the September\u202f2025 cumulative update for Windows\u202f11\u202f2024\u202fLTSC and Windows Server\u202f2025, which includes the CLFS.sys fix.", "For systems still on Windows\u202f11\u202f1123h2 or earlier, schedule an OS upgrade to a supported version that incorporates the update or apply the cumulative upgrade as soon as possible.", "Monitor system stability logs for unexpected bug checks and ensure regular backups are performed to recover from any accidental crashes."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service (system crash)"}, "threat_synthesis": {"affected_systems": "Microsoft Windows users are affected, specifically those running Windows 11 1123h2 or earlier, and earlier builds of Windows 11 2024\u202fLTSC and Windows Server 2025. Microsoft released a silent fix in the September\u202f2025 cumulative update for Windows 11 2024\u202fLTSC and Windows Server 2025, which also covered the Windows\u202f25H2 release in September. Systems that have not applied that update remain vulnerable. ", "description_and_impact": "The flaw originates from improper handling of special elements in the CLFS.sys file system driver, a CWE\u2011159 weakness that can lead an attacker to trigger the KeBugCheckEx routine. When an unprivileged user crafts a malicious input, the driver fails in a way that forces the kernel to issue a bug check, resulting in a non\u2011recoverable system crash. The consequence is a loss of service and potential data loss, and the flaw does not require elevated privileges. ", "risk_and_exploitability": "The CVSS score of\u202f5.5 reflects a moderate impact with local attack potential. EPSS indicates a very low exploitation probability (<\u202f1\u202f%). The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. An attacker only needs local access and does not require any network privileges; the vulnerability is therefore most likely exploited through local user interaction or scripts that run with non\u2011elevated rights."}}}}, "created": "2026-02-26T13:15:00.566413+00:00", "updated": "2026-04-18T10:45:43.656651+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$windows", "microsoft$PRODUCT$windows_11", "microsoft$PRODUCT$windows_11_23h2", "microsoft$PRODUCT$windows_11_25h2", "microsoft$PRODUCT$windows_server_2025"]}