A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Six years. Gartner® Magic Quadrant™ Leader.Find Out Why
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2023-23376

CVE-2023-23376: Windows 10 Privilege Escalation Flaw

CVE-2023-23376 is a privilege escalation vulnerability in the Windows Common Log File System Driver affecting Windows 10 1507. Attackers can exploit this flaw to gain elevated privileges on affected systems.

Updated: May 14, 2026

CVE-2023-23376 Overview

CVE-2023-23376 is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver. The flaw allows a local attacker with low-privileged access to execute code with SYSTEM privileges on affected Windows desktop and server platforms. Microsoft disclosed the issue in February 2023, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The vulnerability is associated with [CWE-122] heap-based buffer overflow and [CWE-787] out-of-bounds write conditions in the CLFS.sys kernel driver. Affected products include Windows 10, Windows 11, and Windows Server 2008 through 2022.

Critical Impact

Successful exploitation grants SYSTEM-level privileges, enabling full host compromise from any authenticated local user context.

Affected Products

  • Microsoft Windows 10 (1507, 1607, 1809, 20H2, 21H2, 22H2)
  • Microsoft Windows 11 (21H2, 22H2)
  • Microsoft Windows Server 2008, 2012, 2016, 2019, and 2022

Discovery Timeline

  • 2023-02-14 - CVE-2023-23376 published to the National Vulnerability Database (NVD)
  • 2023-02-14 - Microsoft releases security update addressing the vulnerability
  • 2025-10-27 - Last updated in NVD database

Technical Details for CVE-2023-23376

Vulnerability Analysis

The vulnerability resides in the Common Log File System (CLFS) driver, CLFS.sys, a general-purpose logging subsystem used by both kernel and user-mode applications in Windows. CLFS exposes attack surface to any local user because logs can be created and manipulated without elevated privileges. An attacker who authenticates locally can trigger a memory corruption condition in the driver and gain SYSTEM execution. Microsoft classifies this as an elevation of privilege issue, and CISA's KEV listing confirms threat actors have weaponized it in real-world intrusions. The bug is commonly chained with initial-access techniques such as phishing payloads or post-exploitation tooling delivered through commodity loaders.

Root Cause

The root cause involves improper validation of structures parsed from CLFS Base Log Files (.blf). Mapped to [CWE-122] and [CWE-787], the driver performs writes outside the bounds of allocated heap structures when processing crafted log metadata. This memory corruption is leveraged to overwrite kernel objects, ultimately redirecting execution or escalating the token of an attacker-controlled process to SYSTEM.

Attack Vector

Exploitation requires local authenticated access. An attacker drops a malicious .blf file or invokes CLFS APIs with crafted parameters from a low-privileged process. The driver parses the attacker-controlled data, triggers the out-of-bounds write, and corrupts kernel memory. Public reporting links this CVE to ransomware operators using it as a post-compromise privilege escalation primitive.

No verified public proof-of-concept code is referenced in the available sources. Technical details for defenders are available in the Microsoft Security Response Center advisory and the CISA Known Exploited Vulnerabilities Catalog.

Detection Methods for CVE-2023-23376

Indicators of Compromise

  • Creation of unexpected .blf (Base Log File) artifacts in writable user directories such as %TEMP%, %APPDATA%, or C:\Users\Public\.
  • Unsigned or unusual processes invoking CLFS APIs (CreateLogFile, AddLogContainer) shortly before a privilege escalation event.
  • New SYSTEM-level child processes spawned from medium-integrity parents without a corresponding UAC consent prompt.

Detection Strategies

  • Hunt for child processes running as NT AUTHORITY\SYSTEM whose parent process token is a standard user, indicating token theft or kernel exploitation.
  • Correlate CLFS driver crashes (CLFS.sys bugchecks in WER or MEMORY.DMP) with prior process activity from non-administrative users.
  • Monitor for sequences where commodity loaders (SmokeLoader, Nokoyawa, Cobalt Strike beacons) are followed by lateral movement and credential dumping consistent with SYSTEM access.

Monitoring Recommendations

  • Enable Windows kernel auditing for driver load events (Event ID 6) and process creation events (Event ID 4688) with command-line logging.
  • Forward endpoint telemetry to a centralized analytics platform and alert on token elevation anomalies and unsigned binary execution in user-writable paths.
  • Track the CLFS.sys file version on managed endpoints to confirm patch deployment status across the fleet.

How to Mitigate CVE-2023-23376

Immediate Actions Required

  • Apply Microsoft's February 2023 security updates to all affected Windows 10, Windows 11, and Windows Server systems immediately.
  • Prioritize patching for systems where users browse the web, open email, or run untrusted software, as these are the most common initial-access vectors paired with this CVE.
  • Audit endpoints against the CISA KEV remediation deadline and confirm CLFS.sys reflects the patched build number.

Patch Information

Microsoft addressed CVE-2023-23376 in the February 14, 2023 security release. Refer to the Microsoft Security Update Guide entry for CVE-2023-23376 for the specific KB articles and cumulative updates aligned to each affected Windows build.

Workarounds

  • No officially supported workaround exists; patching is the only complete remediation.
  • Restrict local logon rights and remove unnecessary administrative accounts to reduce the population of users who can stage exploitation.
  • Enforce application allowlisting to block unauthorized binaries from writing .blf files and invoking CLFS APIs from untrusted directories.
bash
# Verify the patched CLFS driver version on a Windows host (PowerShell)
Get-Item C:\Windows\System32\drivers\CLFS.sys |
    Select-Object -ExpandProperty VersionInfo |
    Format-List ProductVersion, FileVersion, OriginalFilename

# Confirm the February 2023 cumulative update is installed
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2023-02-14') } |
    Sort-Object InstalledOn -Descending

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypePrivilege Escalation

  • Vendor/TechWindows

  • SeverityHIGH

  • CVSS Score7.8

  • EPSS Probability17.85%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityHigh
  • CISA KEV Information
  • In CISA KEVYes
  • CWE References
  • CWE-122

  • CWE-787
  • Technical References
  • CISA Known Exploited Vulnerability
  • Vendor Resources
  • Microsoft CVE-2023-23376 Update
  • Related CVEs
  • CVE-2026-41088: Windows 10 21h2 Privilege Escalation Flaw

  • CVE-2026-41095: Windows Server 2012 Privilege Escalation

  • CVE-2026-40382: Windows 10 1607 Privilege Escalation Flaw

  • CVE-2026-40397: Windows 10 1607 Privilege Escalation Flaw
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English