uname1able/CVE-2026-20820

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a C++ program that creates a CLFS log file, adds a container, allocates a buffer crossing a page boundary, and sends a crafted DeviceIoControl request with a specific IOCTL code (0x80076816) to trigger a heap-based buffer overflow in the Windows CLFS driver, as described in CVE-2026-20820.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a single C++ source file that demonstrates a local privilege escalation exploit for CVE-2026-20820. The code creates a CLFS log, adds a container, allocates memory, and sends a crafted DeviceIoControl request to trigger a heap-based buffer overflow in the CLFS driver. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present. The code performs only the described exploit steps and then cleans up and exits.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC++
Target softwareWindows Common Log File System Driver (clfs.sys)
Attack typesheap-based buffer overflowlocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively constructs a payload and sends a DeviceIoControl call with a specific IOCTL to a CLFS log handle, with the stated intent of triggering an OOB write (line 96). This is an attempt to exercise the vulnerability, not merely detect it.

poc/poc.cpp:96-104

Requirements

  • The attacker must have local authorized access to the system (PR:L).poc/poc.cpp:1-123
  • The target system must be running a vulnerable version of Windows with the CLFS driver.README.md:4-8

Observed behavior

  • Creates a CLFS log file named 'LOG:minpoc' using CreateLogFile.poc/poc.cpp:28-35
  • Adds a log container 'mincont' of 1MB using AddLogContainer.poc/poc.cpp:47-48
  • Allocates two pages of memory and positions a 576-byte buffer to cross a page boundary.poc/poc.cpp:73-89
  • Crafts a payload in the buffer with specific values at offsets 24, 40, and 48.poc/poc.cpp:92-94
  • Sends a DeviceIoControl request with IOCTL 0x80076816 using the crafted buffer as the output buffer to trigger an out-of-bounds write.poc/poc.cpp:97-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Ioctl
0x80076816ULCustom IOCTL code used to trigger the vulnerable code path in the CLFS driver.poc/poc.cpp:17
Exploit Memory Layout
buf = pages + si.dwPageSize - 576Buffer positioned across a page boundary to trigger an out-of-bounds write during the DeviceIoControl call.poc/poc.cpp:88-89
Review boundaries

What the analysis did not establish

  • The evidence does not include the compiled binary or execution output, so the exploit's success or reliability cannot be confirmed.
  • The IOCTL code 0x80076816 is not verified against public CLFS driver documentation; it is assumed to be the trigger based on the code comments.
  • The README.md lists target Windows versions but does not confirm the exploit was tested on them.
  • One file (metadata only) was omitted from the evidence; its content was not reviewed.
  • Binary files were flagged but not analyzed; no binary content was inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1