CVE-2026-62728: Windows 10 1607 Race Condition Vulnerability

CVE-2026-62728 Overview

CVE-2026-62728 is a Time-of-Check Time-of-Use (TOCTOU) race condition in the Windows Common Log File System (CLFS) driver. An authorized local attacker can exploit the race window between validation and use of a resource to elevate privileges on the affected system. Microsoft published the advisory on 2026-08-11, and the flaw affects supported Windows client and server releases from Windows 10 1607 through Windows Server 2025.

Critical Impact
Successful exploitation grants the attacker elevated privileges in the kernel context, providing full confidentiality, integrity, and availability impact on the target host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62728 published to the National Vulnerability Database
2026-08-11 - Microsoft releases security update guidance via MSRC
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62728

Vulnerability Analysis

The vulnerability resides in the Windows Common Log File System (CLFS.sys) driver, a kernel-mode component responsible for high-performance transaction logging. CLFS has been a recurring target for privilege escalation research because it exposes rich parsing and state-tracking logic to user mode through documented APIs. Attackers frequently abuse CLFS to reach SYSTEM from a low-integrity process.

CVE-2026-62728 is categorized as a TOCTOU race condition. The driver validates a property of an object or memory region, then later operates on that same resource under the assumption the validation still holds. A concurrent thread controlled by the attacker modifies the resource between the check and the use, invalidating the earlier assumption and steering the driver into an unsafe code path. The NVD record links the weakness class to [CWE-125], indicating the unsafe path culminates in an out-of-bounds read of kernel memory.

Root Cause

The root cause is missing atomicity between validation and dereference of a shared structure inside CLFS. Because CLFS state can be manipulated from user mode through log handles and metadata operations, a second thread can mutate the underlying buffer or size field after the driver has already sanity-checked it. Subsequent access then reads past the intended bounds or acts on attacker-controlled data.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attack complexity is high because the adversary must reliably win a narrow race window inside the kernel. A typical exploitation flow involves opening a CLFS log file, spawning a racing worker thread that continuously flips a critical field, and repeatedly issuing the vulnerable IOCTL or API until the check-use ordering is violated. Once the race succeeds, the primitive can be leveraged for arbitrary read or corruption of adjacent kernel structures, ultimately yielding SYSTEM privileges. No public proof-of-concept or in-the-wild exploitation has been reported at the time of writing.

// No verified proof-of-concept code is publicly available.
// Refer to the Microsoft advisory for authoritative technical detail:
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62728

Detection Methods for CVE-2026-62728

Indicators of Compromise

Unexpected creation or modification of CLFS log files (.blf, .blf.metadata) in user-writable directories by non-administrative processes.
Processes spawning SYSTEM-level child processes shortly after issuing repeated CLFS-related system calls.
Kernel crashes or KMODE_EXCEPTION_NOT_HANDLED bugchecks referencing CLFS.sys during exploitation attempts.

Detection Strategies

Hunt for standard-user processes that open CLFS log handles and immediately spawn or inject into higher-privileged processes.
Correlate rapid, repeated invocation of CLFS APIs from a single thread group with subsequent token privilege changes.
Baseline legitimate CLFS consumers such as svchost.exe, TxR, and Kernel Transaction Manager services, then flag deviations.

Monitoring Recommendations

Enable Windows kernel auditing and forward Microsoft-Windows-Kernel-General and Microsoft-Windows-CLFS event channels to a centralized log platform.
Alert on process token elevation events (SeDebugPrivilege, SeImpersonatePrivilege) originating from processes that lack a legitimate elevation path.
Monitor for crash dumps referencing CLFS.sys and treat repeated occurrences on the same host as a possible exploitation attempt.

How to Mitigate CVE-2026-62728

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-62728 advisory to every affected Windows client and server build.
Prioritize patching multi-user hosts, jump servers, and terminal servers where low-privileged users share the operating system with sensitive workloads.
Audit local account membership and remove standing local logon rights for accounts that do not require them.

Patch Information

Microsoft has released cumulative security updates addressing CVE-2026-62728 for all supported Windows 10, Windows 11, and Windows Server versions listed in the advisory. Administrators should consult the Microsoft Security Update CVE-2026-62728 page for the specific KB article that matches each product build.

Workarounds

No official workaround is provided by Microsoft; installation of the security update is the supported remediation.
As a compensating control, restrict interactive and remote desktop logon rights on high-value systems to trusted administrators only.
Enforce application allow-listing so that unauthorized binaries cannot execute the CLFS-abusing exploitation code paths.

bash

# Verify the CLFS driver version after patching on a Windows host (PowerShell)
Get-Item C:\Windows\System32\drivers\CLFS.sys | \
    Select-Object Name, @{n='Version';e={$_.VersionInfo.FileVersion}}, LastWriteTime

# Confirm the relevant KB is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10