Windows CLFS.sys Unrecoverable State / BSoD via ReadFile on Log File Handle (CVE-2026-2636)

Metadata

Affected Target

Summary

CVE-2026-2636 is a denial-of-service vulnerability in the Windows Common Log File System driver (CLFS.sys). An unprivileged local user can crash the system simply by calling the ReadFile Win32 API on a handle obtained via CreateLogFile — a call sequence CLFS does not expect and does not validate correctly. The author discovered this while researching an unrelated CLFS RCE and found that certain value changes to that PoC instead produced a reliable, non-exploitable BSoD, which they are reporting as its own issue. Unlike many historical CLFS bugs, this does not require a maliciously crafted .blf log file — it is triggered purely through an unexpected but otherwise legitimate sequence of standard Windows API calls (CreateLogFile followed by ReadFile). The included PoC is a minimal Visual C++ console application that performs exactly these two calls to reproduce the crash.

Vulnerability Details

Root Cause

CWE-159 (Improper Handling of Invalid Use of Special Elements): CLFS.sys does not correctly validate the IRP flag combination generated when ReadFile is called on a handle returned by CreateLogFile. Normally at least one of IRP_PAGING_IO or IRP_INPUT_OPERATION is expected to be set; when both are unset (as happens with this specific overlapped ReadFile call pattern), the driver follows an incorrect handling path that leads to an unrecoverable inconsistency and a call to KeBugCheckEx.

Attack Vector

1. Unprivileged local user runs a program that deletes any pre-existing MyLogFile.blf and calls CreateLogFile to create/open a new CLFS log (LOG:MyLogFile) with FILE_FLAG_OVERLAPPED.
2. The program calls ReadFile on the returned handle with an OVERLAPPED structure — a call sequence CLFS.sys does not correctly validate.
3. The resulting IRP has neither IRP_PAGING_IO nor IRP_INPUT_OPERATION set, driving CLFS.sys into an invalid internal state.
4. CLFS.sys detects the unrecoverable inconsistency and calls KeBugCheckEx, crashing the entire system (BSoD) — no crafted log file content or elevated privileges are required.

Impact

Reliable, unprivileged local denial-of-service: any standard user can crash the entire Windows system, causing an outage/reboot.

Environment / Lab Setup

Target:   Windows 11 23H2 or earlier / Windows 11 2024 LTSC / Windows Server 2025, prior to September 2025 cumulative update
Attacker: Visual Studio (C++ toolchain), local unprivileged user account on the target machine

Proof of Concept

PoC Script

See ConsoleApplication12/CVE-2026-2636_PoC.cpp and the accompanying Visual Studio project files (ConsoleApplication12.sln, ConsoleApplication12.vcxproj) in this folder.

1

ConsoleApplication12.exe

The program deletes any existing MyLogFile.blf, opens a new CLFS log via CreateLogFile, then calls ReadFile on the handle with an overlapped structure — this unexpected but legitimate API sequence drives CLFS.sys into an unrecoverable state and triggers an immediate BSoD.

Detection & Indicators of Compromise

Signs of compromise:

• System crash (BSoD) with a bug check pointing into CLFS.sys shortly after execution of an unfamiliar user-mode process
• Presence of an unexpected .blf log file (e.g. MyLogFile.blf) created by a standard user account
• Crash dump analysis showing a ReadFile call on a CLFS log handle in the failing call stack

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/oxfemale/CVE-2026-2636_PoC on 2026-07-05.