CVE-2026-2636 is a medium-severity vulnerability in the Windows CLFS.sys driver, affecting Windows 11 23H2 and earlier versions. This flaw, categorized as CWE-159, allows an unprivileged user to trigger a system crash (Blue Screen of Death) due to an unrecoverable inconsistency. The vulnerability has a CVSS score of 5.5 (MEDIUM) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a local attack with low complexity and privileges, resulting in high availability impact. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 6 mentions, suggesting awareness among cybersecurity professionals. Microsoft silently patched this issue in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025, with Windows 25H2 released with the fix.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, < 25H2CPE match | cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* | ||
>= 0, <= 1123h2CPE match | cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.