CVE-2026-40397 - Windows Common Log File System Driver Elevation of Privilege Vulnerability

Back Back to CVE browser

HIGH

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Published May 12, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.33%

Description

Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

Affected products

Vendor Microsoft Product Windows 10 Version 1607 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9140
Vendor Microsoft Product Windows 10 Version 1809 Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.8755
Vendor Microsoft Product Windows 10 Version 21H2 Default
unknown
Affected
- ≥ 10.0.19044.0, < 10.0.19044.7291
Vendor Microsoft Product Windows 10 Version 22H2 Default
unknown
Affected
- ≥ 10.0.19045.0, < 10.0.19045.7417
Vendor Microsoft Product Windows 11 Version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7219
Vendor Microsoft Product Windows 11 Version 24H2 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.8457
Vendor Microsoft Product Windows 11 Version 25H2 Default
unknown
Affected
- ≥ 10.0.26200.0, < 10.0.26200.8457
Vendor Microsoft Product Windows 11 version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7079
Vendor Microsoft Product Windows 11 version 26H1 Default
unknown
Affected
- ≥ 10.0.28000.0, < 10.0.28000.2113
Vendor Microsoft Product Windows Server 2012 Default
unknown
Affected
- ≥ 6.2.9200.0, < 6.2.9200.26079
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
unknown
Affected
- ≥ 6.2.9200.0, < 6.2.9200.26079
Vendor Microsoft Product Windows Server 2012 R2 Default
unknown
Affected
- ≥ 6.3.9600.0, < 6.3.9600.23181
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
unknown
Affected
- ≥ 6.3.9600.0, < 6.3.9600.23181
Vendor Microsoft Product Windows Server 2016 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9140
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9140
Vendor Microsoft Product Windows Server 2019 Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.8755
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.8755
Vendor Microsoft Product Windows Server 2022 Default
unknown
Affected
- ≥ 10.0.20348.0, < 10.0.20348.5139
Vendor Microsoft Product Windows Server 2022, 23H2 Edition (Server Core installation) Default
unknown
Affected
- ≥ 10.0.25398.0, < 10.0.25398.2330
Vendor Microsoft Product Windows Server 2025 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.32860
Vendor Microsoft Product Windows Server 2025 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.32860

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 10 Version 1607	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9140
Microsoft	Windows 10 Version 1809	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.8755
Microsoft	Windows 10 Version 21H2	unknown	Affected ≥ 10.0.19044.0, < 10.0.19044.7291
Microsoft	Windows 10 Version 22H2	unknown	Affected ≥ 10.0.19045.0, < 10.0.19045.7417
Microsoft	Windows 11 Version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7219
Microsoft	Windows 11 Version 24H2	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.8457
Microsoft	Windows 11 Version 25H2	unknown	Affected ≥ 10.0.26200.0, < 10.0.26200.8457
Microsoft	Windows 11 version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7079
Microsoft	Windows 11 version 26H1	unknown	Affected ≥ 10.0.28000.0, < 10.0.28000.2113
Microsoft	Windows Server 2012	unknown	Affected ≥ 6.2.9200.0, < 6.2.9200.26079
Microsoft	Windows Server 2012 (Server Core installation)	unknown	Affected ≥ 6.2.9200.0, < 6.2.9200.26079
Microsoft	Windows Server 2012 R2	unknown	Affected ≥ 6.3.9600.0, < 6.3.9600.23181
Microsoft	Windows Server 2012 R2 (Server Core installation)	unknown	Affected ≥ 6.3.9600.0, < 6.3.9600.23181
Microsoft	Windows Server 2016	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9140
Microsoft	Windows Server 2016 (Server Core installation)	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9140
Microsoft	Windows Server 2019	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.8755
Microsoft	Windows Server 2019 (Server Core installation)	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.8755
Microsoft	Windows Server 2022	unknown	Affected ≥ 10.0.20348.0, < 10.0.20348.5139
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	unknown	Affected ≥ 10.0.25398.0, < 10.0.25398.2330
Microsoft	Windows Server 2025	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.32860
Microsoft	Windows Server 2025 (Server Core installation)	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.32860

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-191

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29659
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40397
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29659		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40397		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published May 12, 2026

Updated Aug 10, 2026

Reserved Apr 13, 2026

Link CVE-2026-40397

CISA Vulnrichment

Updated May 13, 2026

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2026-40397

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published May 12, 2026

Updated Aug 10, 2026

Link EUVD-2026-29659

GitHub

No data