CVE-2026-20820

HIGH

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-20820 has a selected CVSS score of 7.8 (high); EIP currently links 1 repository PoC.

Description

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Description source: GitHub Advisory

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 14, 2026 · Source: CVE List

Affected products and versions

Showing 12 of 23
ProductSourceVersion range

Windows 10 Version 1607

Browse Microsoft / Windows 10 Version 1607
CVE List10.0.14393.0 to < 10.0.14393.8783affected

Windows 10 Version 1809

Browse Microsoft / Windows 10 Version 1809
CVE List10.0.17763.0 to < 10.0.17763.8276affected

Windows 10 Version 21H2

Browse Microsoft / Windows 10 Version 21H2
CVE List10.0.19044.0 to < 10.0.19044.6809affected

Windows 10 Version 22H2

Browse Microsoft / Windows 10 Version 22H2
CVE List10.0.19045.0 to < 10.0.19045.6809affected

Windows 11 Version 23H2

Browse Microsoft / Windows 11 Version 23H2
CVE List10.0.22631.0 to < 10.0.22631.6491affected

Windows 11 Version 24H2

Browse Microsoft / Windows 11 Version 24H2
CVE List10.0.26100.0 to < 10.0.26100.7623affected

Windows 11 Version 25H2

Browse Microsoft / Windows 11 Version 25H2
CVE List10.0.26200.0 to < 10.0.26200.7623affected

Windows Server 2008 R2 Service Pack 1

Browse Microsoft / Windows Server 2008 R2 Service Pack 1
CVE List6.1.7601.0 to < 6.1.7601.28117affected

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

Browse Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)
CVE List6.1.7601.0 to < 6.1.7601.28117affected

Windows Server 2008 Service Pack 2

Browse Microsoft / Windows Server 2008 Service Pack 2
CVE List6.0.6003.0 to < 6.0.6003.23717affected

Windows Server 2008 Service Pack 2 (Server Core installation)

Browse Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)
CVE List6.0.6003.0 to < 6.0.6003.23717affected

Windows Server 2012

Browse Microsoft / Windows Server 2012
CVE List6.2.9200.0 to < 6.2.9200.25868affected

Proofs of concept

1

Repository PoCs

GitHubuname1able/CVE-2026-20820Repository PoCby uname1able0Exploit3 files

3.7 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a C++ program that creates a CLFS log file, adds a container, allocates a buffer crossing a page boundary, and sends a crafted DeviceIoControl request with a specific IOCTL code (0x80076816) to trigger a heap-based buffer overflow in the Windows CLFS driver, as described in CVE-2026-20820.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a single C++ source file that demonstrates a local privilege escalation exploit for CVE-2026-20820. The code creates a CLFS log, adds a container, allocates memory, and sends a crafted DeviceIoControl request to trigger a heap-based buffer overflow in the CLFS driver. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is present. The code performs only the described exploit steps and then cleans up and exits.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC++
Target softwareWindows Common Log File System Driver (clfs.sys)
Attack typesheap-based buffer overflowlocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively constructs a payload and sends a DeviceIoControl call with a specific IOCTL to a CLFS log handle, with the stated intent of triggering an OOB write (line 96). This is an attempt to exercise the vulnerability, not merely detect it.

poc/poc.cpp:96-104

Requirements

  • The attacker must have local authorized access to the system (PR:L).poc/poc.cpp:1-123
  • The target system must be running a vulnerable version of Windows with the CLFS driver.README.md:4-8

Observed behavior

  • Creates a CLFS log file named 'LOG:minpoc' using CreateLogFile.poc/poc.cpp:28-35
  • Adds a log container 'mincont' of 1MB using AddLogContainer.poc/poc.cpp:47-48
  • Allocates two pages of memory and positions a 576-byte buffer to cross a page boundary.poc/poc.cpp:73-89
  • Crafts a payload in the buffer with specific values at offsets 24, 40, and 48.poc/poc.cpp:92-94
  • Sends a DeviceIoControl request with IOCTL 0x80076816 using the crafted buffer as the output buffer to trigger an out-of-bounds write.poc/poc.cpp:97-104
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Ioctl
Payload withheldCustom IOCTL code used to trigger the vulnerable code path in the CLFS driver.poc/poc.cpp:17
Exploit Memory Layout
Payload withheldBuffer positioned across a page boundary to trigger an out-of-bounds write during the DeviceIoControl call.poc/poc.cpp:88-89
Review boundaries

What the analysis did not establish

  • The evidence does not include the compiled binary or execution output, so the exploit's success or reliability cannot be confirmed.
  • The IOCTL code 0x80076816 is not verified against public CLFS driver documentation; it is assumed to be the trigger based on the code comments.
  • The README.md lists target Windows versions but does not confirm the exploit was tested on them.
  • One file (metadata only) was omitted from the evidence; its content was not reviewed.
  • Binary files were flagged but not analyzed; no binary content was inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Research & analysis

1
Technical blogTom Brice (Inbits Blog)Source: EIP research review

CVE-2026-20820 Root Cause Analysis

Inbits Blog provides a root cause analysis of CVE-2026-20820, a Windows CLFS.sys driver vulnerability patched in January 2026. The CclfsRequest::ScanContainers function calculates the expected output length as ContainerCount * 0x240 (size of CLS_CONTAINER_INFORMATION) but fails to account for the 0x38-byte CLS_SCAN_CONTEXT object that also occupies the output buffer. This causes up to 0x38 bytes of the last CLS_CONTAINER_INFORMATION object (State, PhysicalContainerId, LogicalContainerId, and final 0x28 bytes of FileName) to be written past the buffer boundary. The analysis includes patch diffing showing the added bounds check and integer overflow guard, and confirms the bug via a guard-page BSOD proof of concept. The author notes the MSRC advisory classifies it as heap-based overflow but the observed behavior is an overflow of System PTE pages mapped for the MDL output buffer. CravateRouge independently confirms the same root cause, IOCTL mechanism, and MDL-backed buffer behavior.

Root causeTechnical detailPoC researchContext
https://inbits-sec.com/posts/cve-2026-20820-root-cause
Research notes
  • Root cause
    The CclfsRequest::ScanContainers function calculates expected output length as ContainerCount * 0x240 but fails to account for the 0x38-byte CLS_SCAN_CONTEXT object that precedes the container data in the output buffer, causing up to 0x38 bytes of out-of-bounds write.
    CVE-2026-20820 Root Cause Analysis
  • Technical detail
    The IOCTL 0x80076816 uses METHOD_OUT_DIRECT: the output buffer is Direct I/O (MDL-backed) and serves as both input (CLS_SCAN_CONTEXT) and output (CLS_CONTAINER_INFORMATION array). The overflow writes the State, PhysicalContainerId, LogicalContainerId, and final 0x28 bytes of FileName past the buffer boundary.
    CVE-2026-20820 Root Cause Analysis
  • PoC research
    A guard-page BSOD proof of concept confirms the vulnerability: positioning the user-land buffer at the end of a memory page with an adjacent guard page causes a kernel page fault when the driver writes beyond the buffer.
    CVE-2026-20820 Root Cause Analysis
  • Context
    The author notes the MSRC advisory classifies the CVE as a heap-based buffer overflow, but the observed overflow occurs in System PTE pages mapped for the MDL output buffer, not a heap allocation. The discrepancy is unresolved.
    CVE-2026-20820 Root Cause Analysis
Supporting sources
ReferenceChasing the Ghost in the Log: A Deep Dive into CVE-2026-20820

References

2