{"id":10954,"date":"2026-02-26T10:03:45","date_gmt":"2026-02-26T10:03:45","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/26\/poc-released-for-windows-vulnerability-that-allows-attackers-to-cause-unrecoverable-bsod-crashes\/"},"modified":"2026-02-26T10:03:45","modified_gmt":"2026-02-26T10:03:45","slug":"poc-released-for-windows-vulnerability-that-allows-attackers-to-cause-unrecoverable-bsod-crashes","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/26\/poc-released-for-windows-vulnerability-that-allows-attackers-to-cause-unrecoverable-bsod-crashes\/","title":{"rendered":"PoC Released for Windows Vulnerability That Allows Attackers to Cause Unrecoverable BSOD Crashes"},"content":{"rendered":"<p>    PoC Released for Windows Vulnerability That Allows Attackers to Cause Unrecoverable BSOD Crashes<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p>A proof-of-concept (PoC) exploit has been publicly released for\u00a0CVE-2026-2636, a newly documented vulnerability in <a href=\"https:\/\/cybersecuritynews.com\/windows-common-log-file-system-vulnerability\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Windows\u2019 Common Log File System (CLFS) driver<\/a> that allows any low-privileged, unprivileged user to instantly crash a target system into an unrecoverable Blue Screen of Death (BSoD).<\/p>\n<p>The vulnerability was discovered by Ricardo Narvaja of Fortra during CLFS-focused vulnerability research and has been classified as a Denial-of-Service (DoS) flaw with a CVSS base score of 5.5.<\/p>\n<p>The vulnerability stems from improper flag validation within the\u00a0<code>CLFS!CClfsRequest::ReadLogPagingIo<\/code>\u00a0function inside\u00a0<code>CLFS.sys<\/code>\u00a0(tested on version 10.0.22621.5037).<\/p>\n<p>When a specific sequence of Windows API calls is made, the CLFS driver processes an I\/O Request Packet (IRP) with critical flags in a disabled state, triggering a logic path that directly invokes\u00a0<code>nt!KeBugCheckEx<\/code>\u00a0Windows\u2019 kernel-level panic handler places the system in an irreversible crash state.<\/p>\n<p>The two key flags involved are:<\/p>\n<ul class=\"wp-block-list\">\n<li>IRP_PAGING_IO (0x02):\u00a0Signals that the I\/O request relates to memory paging operations, such as paging file or memory-mapped file access.<\/li>\n<li>IRP_INPUT_OPERATION:\u00a0Indicates that the I\/O operation involves input data transfer, such as reading from a device or file.<\/li>\n<\/ul>\n<p>For\u00a0<code>ReadLogPagingIo<\/code>\u00a0to process a request correctly, at least one of these flags must be enabled. In the PoC scenario, both flags were disabled (AL =\u00a0<code>0x0<\/code>), causing the driver to follow an incorrect execution path.<\/p>\n<p>The internal flag value\u00a0<code>0x42<\/code>\u00a0tested during research had no documented behavior from Microsoft, highlighting a gap in public kernel documentation.<\/p>\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEifeswZqrqfKmjpGvtlififffLZTJ_S3-fwN07nArF1s_LjOkXCQrSM-IJs8Z_l1Hz6DWelFHkBgnTwhT1S7I7oxcXCbFEO8oUD-VZWv9gfXVp5f0Y2SYQeUGoaVAD-jl-cuqyubOJqHxlF7Jo69PSVZ5TS9BXWx4y__sbFw-EmUOuG-Bh_qtfhFg3nA2Bv\/s16000\/BSD%2520Crash.webp?ssl=1\" alt=\"BSOD Screen\"><figcaption class=\"wp-element-caption\">BSOD Screen (source: coresecurity)<\/figcaption><\/figure>\n<p>The BSoD crash chain is deterministic and begins from user-space with a standard\u00a0<code>ReadFile<\/code>\u00a0API call. The full kernel call stack captured during exploitation is:<\/p>\n<pre class=\"wp-block-preformatted\">text<code>nt!DbgBreakPointWithStatus\nnt!KiBugCheckDebugBreak+0x12\nnt!KeBugCheck2+0xba3\nnt!KeBugCheckEx+0x107\nCLFS!CClfsRequest::ReadLogPagingIo+0xfc2f\nCLFS!CClfsRequest::Dispatch+0x9c\nCLFS!ClfsDispatchIoRequest+0x8e\nCLFS!CClfsDriver::LogIoDispatch+0x27\nnt!IofCallDriver+0x55\nnt!IopSynchronousServiceTail+0x46f\nnt!IopReadFile+0x4d4\nnt!NtReadFile+0xdb\n<\/code><\/pre>\n<p>The call originates from\u00a0<code>KERNELBASE!ReadFile<\/code>, which triggers\u00a0<code>nt!NtReadFile<\/code>, escalating through the CLFS dispatch chain until the driver\u2019s inconsistent state invokes\u00a0<code>KeBugCheckEx<\/code>. The entire chain is reproducible without elevated privileges, making this particularly dangerous in multi-user or shared enterprise environments.<\/p>\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjjxz2pKUm6SdIDbCfJQFE_efUUthWEG2qFLbwhDmWcGu5Nchp7PUOWrnwmnt9JRXh4zGzSYoBEo9qtpwBXRusVShk_zVyB3yNLFZqetHXHlnh8nbBZjM3REBYaxw9_27olTBXbjIJZ3kjCyIvNCYiNJTzWoZaRUABTFi0pZTHtGc_XjepZX18gt83Ci04\/s1600\/Screenshot%25202026-02-26%2520130623%2520%25281%2529.webp?ssl=1\" alt=\"The PoC triggers nt!KeBugCheckEx causing a system crash (source : coresecurity )\"><figcaption class=\"wp-element-caption\">The PoC triggers <strong>nt!KeBugCheckEx<\/strong> is causing a system crash (source: coresecurity )<\/figcaption><\/figure>\n<p><a href=\"https:\/\/www.coresecurity.com\/blog\/cve-2026-2636-blf-log-file-unrecoverable-state-bsod\" target=\"_blank\" rel=\"noreferrer noopener\"><\/a>\u200bThe PoC requires only\u00a0<strong>two API calls<\/strong>\u00a0and involves no crafted binary files or heap spray techniques. The attack sequence uses\u00a0<code>CreateLogFile<\/code>\u00a0to obtain a valid\u00a0<code>.blf<\/code>\u00a0log file handle, followed immediately by a\u00a0<code>ReadFile<\/code>\u00a0call on that same handle.<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https:\/\/www.coresecurity.com\/blog\/cve-2026-2636-blf-log-file-unrecoverable-state-bsod\"><\/a>\u200b<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh1vWl9PnpYN_Vwsevb80btUnNMSsDodxseP24vaiwRdP4jA8dSSc15SF-mdd6vD2vaDBEjCYmtYOI8KueEVDCykar2broitVzgfQFy6QRkQ9maS7D6f9yVGK2qGCQv1igoYM69mYB4ManUqap9zQn436QB7KJcaDdMWNCUEnvLpoTGRrx6YtYxxtFiI5g\/s1600\/Screenshot%25202026-02-26%2520131152%2520%25281%2529.webp?ssl=1\" alt=\"meaning of\u00a0IRP_PAGING_IO (source : coresecurity)\"><figcaption class=\"wp-element-caption\">meaning of\u00a0IRP_PAGING_IO (source: coresecurity)<\/figcaption><\/figure>\n<\/div>\n<p>This call combination is inherently unexpected by the CLFS driver subsystem. Since\u00a0<code>ReadFile<\/code>\u00a0is not designed to operate on CLFS log handles in this context, the driver fails to handle the request gracefully and instead cascades into a kernel panic.<\/p>\n<p> The simplicity of this PoC lowers the exploitation barrier significantly, meaning even a script-kiddie-level threat actor could deploy it as a disruptive denial-of-service tool in enterprise Windows environments.<\/p>\n<p><a href=\"https:\/\/www.coresecurity.com\/blog\/cve-2026-2636-blf-log-file-unrecoverable-state-bsod\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Ricardo Narvaja of Fortra added that<\/a> Microsoft\u00a0silently fixed\u00a0this vulnerability as part of the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2, released in September 2025, shipped with the fix already included. However,\u00a0Windows 11 23H2 and all earlier versions remain unpatched\u00a0and are currently vulnerable.<a href=\"https:\/\/www.coresecurity.com\/blog\/cve-2026-2636-blf-log-file-unrecoverable-state-bsod\" target=\"_blank\" rel=\"noreferrer noopener\"><\/a>\u200b<\/p>\n<p>This follows a pattern of recurring CLFS driver vulnerabilities that have plagued Windows for years, including CVE-2022-37969, CVE-2023-28252, CVE-2024-6768, and the actively ransomware-exploited <a href=\"https:\/\/cybersecuritynews.com\/microsoft-patch-tuesday-april-2025\/\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2025-29824<\/a>, all rooted in the same CLFS.sys driver subsystem.<\/p>\n<h2 class=\"wp-block-heading\" id=\"mitigation-recommendations\"><strong>Mitigation Recommendations<\/strong><\/h2>\n<ul class=\"wp-block-list\">\n<li>Apply September 2025 or later cumulative updates\u00a0for all Windows 11 and Windows Server 2025 deployments immediately.<\/li>\n<li>Upgrade to Windows 11 2024 LTSC or Windows 25H2\u00a0on supported hardware to ensure the fix is present.<\/li>\n<li>Restrict local logon access\u00a0on sensitive systems to reduce the attack surface, given the local (AV:L) attack vector.<\/li>\n<li>Monitor for anomalous CLFS API calls,\u00a0such as\u00a0<code>ReadFile<\/code>\u00a0invocations against log file handles, which are not standard operational patterns.<\/li>\n<li>Audit and prioritize patching\u00a0on multi-user environments, kiosks, and enterprise workstations where low-privileged accounts are active.<\/li>\n<\/ul>\n<p>Organizations running <a href=\"https:\/\/cybersecuritynews.com\/microsoft-warns-of-windows-11-23h2\/\" target=\"_blank\" rel=\"noreferrer noopener\">unpatched Windows 11 23H2<\/a> or older builds should treat this as a high-priority patching action, particularly in environments where system availability is critical and local user access cannot be fully restricted.<\/p>\n<p class=\"has-text-align-center has-background\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 94%,rgb(169,184,195) 100%)\"><strong>Follow us on <a href=\"https:\/\/news.google.com\/publications\/CAAqMggKIixDQklTR3dnTWFoY0tGV041WW1WeWMyVmpkWEpwZEhsdVpYZHpMbU52YlNnQVAB?hl=en-IN&amp;gl=IN&amp;ceid=IN:en\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Google News<\/a>, <a href=\"https:\/\/www.linkedin.com\/company\/cybersecurity-news\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">LinkedIn<\/a>, and <a href=\"https:\/\/x.com\/cyber_press_org\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">X<\/a> for daily cybersecurity updates. <a href=\"https:\/\/cybersecuritynews.com\/contact-us\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Contact us<\/a> to feature your stories.<\/strong><\/p>\n<p>The post <a href=\"https:\/\/cybersecuritynews.com\/windows-vulnerability-bsod-crashes\/\">PoC Released for Windows Vulnerability That Allows Attackers to Cause Unrecoverable BSOD Crashes<\/a> appeared first on <a href=\"https:\/\/cybersecuritynews.com\/\">Cyber Security News<\/a>.<\/p>\n<\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Guru Baran<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/cybersecuritynews.com\/windows-vulnerability-bsod-crashes\/\">Go to cyber-security-news<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>PoC Released for Windows Vulnerability That Allows Attackers to Cause Unrecoverable BSOD Crashes A proof-of-concept (PoC) exploit has been publicly released for\u00a0CVE-2026-2636, a newly documented vulnerability in Windows\u2019 Common Log File System (CLFS) driver that allows any low-privileged, unprivileged user to instantly crash a target system into an unrecoverable Blue Screen of Death (BSoD). The [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,648,395],"tags":[130],"class_list":["post-10954","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability-news","category-windows","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10954"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10954"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10954\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}