CVE-2023-28252 is a Windows kernel privilege escalation vulnerability in clfs.sys (Common Log File System). The vulnerability lies within the function handling how the CLFS driver extends or writes metadata blocks (CClfsBaseFilePersisted::ExtendMetadataBlock). An attacker with low-level local access can craft a malicious Base Log File (.blf). When the operating system processes this manipulated structure, it triggers an out-of-bounds increment. By corrupting kernel memory blocks, the exploit swaps the calling process's token with the Windows SYSTEM token, instantly granting full administrative control over the machine
Post summary
The post outlines the CVE‑2023‑28252 privilege‑escalation flaw in Windows' CLFS driver, detailing how a crafted .blf file can swap the process token to SYSTEM, but offers no PoC, exploit, patch, or evidence of active exploitation.
