Log In Get API Key

6.8Medium

CVE-2024-6768Denial of Service in CLFS.sys

Microsoft Windows 10; Microsoft Windows 11; Microsoft Windows Server 2016; Microsoft Windows Server 2019 Published: 2024-08-12 21:29 (2 years ago)

Description

A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated low-privilege user to cause a Blue Screen of Death via a forced call to the KeBugCheckEx function.

Weakness (CWE): CWE-1284

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Microsoft	Windows 10	10.0.0
Microsoft	Windows 11	10.0.0
Microsoft	Windows Server 2016	10.0.0
Microsoft	Windows Server 2019	10.0.0
Microsoft	Windows Server 2022	10.0.0

References and patches

https://www.fortra.com/security/advisories/research/fr-2024-001

CVSS score

6.8Medium

Source: Fortra · CVSS 4.0

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality: None
Integrity: None
Availability: High

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS (chance of exploitation in 30 days)

2.51%

higher than 85% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2024-07-15
Published2024-08-12 21:29
Reached IP-DB2026-10-24 23:55
Last updated2025-09-15 20:28

Assigned by (CNA): Fortra

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Windows 10

7.5High

CVE-2026-118148 3 days ago

Active Directory Domain Services Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Improper authentication in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

7.8High

CVE-2026-119382 3 days ago

Windows TPM Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.

5.9Medium

CVE-2026-122474 3 days ago

Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Time-of-check time-of-use (toctou) race condition in Windows Security Account Manager allows an unauthorized attacker to bypass a security feature over a network.

7.8High

CVE-2026-122183 3 days ago

Windows Kernel Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

5.5Medium

CVE-2026-122297 3 days ago

Windows Kernel Transaction Manager Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information locally.

7.0High

CVE-2026-122179 3 days ago

Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally.